---
id: CVE-2025-13030
aliases:
  - GHSA-qp2c-xqv6-phh6
  - PYSEC-2026-2450
title: django-mdeditor is Missing Authentication for Critical Function
summary: django-mdeditor is Missing Authentication for Critical Function
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'
vendor: django-mdeditor
product: django-mdeditor
ecosystem: pip
affected:
  - django-mdeditor <= 0.1.20
published: '2026-04-30'
updated: '2026-07-13'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-qp2c-xqv6-phh6'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-13030'
  - url: 'https://github.com/pylixm/django-mdeditor/issues/151'
  - url: 'https://github.com/pylixm/django-mdeditor/pull/185'
  - url: >-
      https://github.com/pylixm/django-mdeditor/commit/3e80f9edcabc5d2fc136b05a501964b8a5e97cfe
  - url: 'https://github.com/pylixm/django-mdeditor'
  - url: >-
      https://github.com/pylixm/django-mdeditor/blob/e8dd73fb8571ddff2e7a20a4bfa88c376cc33b62/mdeditor/views.py%23L25
  - url: 'https://security.snyk.io/vuln/SNYK-PYTHON-DJANGOMDEDITOR-8630926'
tags:
  - osv
  - pip
epss: 0.00308
epssPercentile: 0.21011
ingestedAt: '2026-07-13T18:58:02.146Z'
---

## Overview

All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload malicious files and achieve arbitrary code execution since this endpoint lacks authentication protection and proper sanitisation of file names.

## Affected packages

- `django-mdeditor <= 0.1.20`

## Remediation

Refer to the advisory for the patched release.