CVE-2025-13030
All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint.
Published Apr 30, 2026 · updated Oct 14, 2026 · pylixm django-mdeditor
All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload malicious files and achieve arbitrary code execution since this endpoint lacks authentication protection and proper sanitisation of file names.
Timeline
Detection, updates, and resolution for this record.
Apr 30, 2026 · NIST NVD
Detected
All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload malicious files and achieve arbitrary code execution since this endpoint lacks authentication protection and proper sanitisation of file names.
Oct 14, 2026 · NIST NVD
Updated
All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload malicious files and achieve arbitrary code execution since this endpoint lacks authentication protection and proper sanitisation of file names.
Affected
- cpe pylixm/django-mdeditorversion unspecified
Sources
- CVE.orgCVE-2025-13030
Official CVE identifier
cve.org - NIST NVDCVE-2025-13030
All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload malicious files and achieve arbitrary code execution since this endpoint lacks authentication protection and proper sani
nvd.nist.gov