VulnerabilityAnalyzed

CVE-2025-13030

All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint.

LOW 2.0EPSS 0.31%

Does this matter?

Lower severity and a low EPSS score (0.31%). Track it; it rarely justifies an emergency change on its own.

Description

All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload malicious files and achieve arbitrary code execution since this endpoint lacks authentication protection and proper sanitisation of file names.

CVSS 4.0: 2.0 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.31% probability · 23th percentile
CISA KEV: Not listed
Weakness: CWE-306
Affected: pylixm/django-mdeditor
Source: report@snyk.io

References

https://github.com/pylixm/django-mdeditor/blob/e8dd73fb8571ddff2e7a20a4bfa88c376cc33b62/mdeditor/views.py%23L25Broken Link
https://github.com/pylixm/django-mdeditor/commit/3e80f9edcabc5d2fc136b05a501964b8a5e97cfePatch
https://github.com/pylixm/django-mdeditor/issues/151Issue Tracking
https://github.com/pylixm/django-mdeditor/pull/185Issue Tracking
https://security.snyk.io/vuln/SNYK-PYTHON-DJANGOMDEDITOR-8630926Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.