CVE-2025-13030 json
django-mdeditor is Missing Authentication for Critical Function
published 2026-04-30 6 mo ago modified 2026-10-14 26 d ago also GHSA-qp2c-xqv6-phh6 , PYSEC-2026-2450 , EUVD-2025-209593
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 23%
- public exploits
- 0
- none known
Summary
All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload malicious files and achieve arbitrary code execution since this endpoint lacks authentication protection and proper sanitisation of file names.
Patch / fix
- github.com/pylixm/django-mdeditor@3e80f9e commit
- github.com/pylixm/django-mdeditor#185 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.31% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:P |
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L/E:P |
| CNA | 4.0 | 2.0 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L |
| GitHub | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | django-mdeditor | <=0.1.20 |
no fix listed |
Affected products
- n/a django-mdeditor
Classification
- Weakness
-
- CWE-306 Missing Authentication for Critical Functionality
References
-
github.com
/pylixm/django-mdeditor/pull/185
web, issue-tracking
-
github.com
/pylixm/django-mdeditor/commit/3e80f9edcabc5d2fc136b05a501964b8a5e97cfe
web, patch
-
security.snyk.io
/vuln/SNYK-PYTHON-DJANGOMDEDITOR-8630926
web, third-party-advisory
-
github.com
/pylixm/django-mdeditor/blob/e8dd73fb8571ddff2e7a20a4bfa88c376cc33b62/mdeditor/views.py%23L25
web, broken-link
-
github.com
/pylixm/django-mdeditor/issues/151
web, issue-tracking
-
nvd.nist.gov
/vuln/detail/CVE-2025-13030
advisory
-
github.com
/pylixm/django-mdeditor
package
-
pypi.org
/project/django-mdeditor
package
-
github.com
/advisories/GHSA-qp2c-xqv6-phh6
advisory
Sources
- CVE List CVE-2025-13030
- GitHub Advisory GHSA-qp2c-xqv6-phh6
- NVD CVE-2025-13030
- OSV PYSEC-2026-2450
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.