django-mdeditor is Missing Authentication for Critical Function
All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload malicious files and achieve arbitrary code execution since this endpoint lacks authentication protection and proper sanitisation of file names.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-13030US | critical9.8OT elevated | — | ||
All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload malicious files and… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/advisories/GHSA-qp2c-xqv6-phh6ADVISORY
- https://github.com/pylixm/django-mdeditorPACKAGE
- https://github.com/pylixm/django-mdeditor/blob/e8dd73fb8571ddff2e7a20a4bfa88c376cc33b62/mdeditor/views.py%23L25WEB
- https://github.com/pylixm/django-mdeditor/commit/3e80f9edcabc5d2fc136b05a501964b8a5e97cfeWEB
- https://github.com/pylixm/django-mdeditor/issues/151WEB
- https://github.com/pylixm/django-mdeditor/pull/185WEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-13030ADVISORY
- https://pypi.org/project/django-mdeditorPACKAGE
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan