CVE-2025-13030
All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload malicious files and achieve arbitrary code execution since this endpoint lacks authentication protection and proper sanitisation of file names.
Ver en NVDAnálisis
Django-mdeditor contains a vulnerability in its image upload endpoint that allows unauthenticated attackers to upload malicious files and potentially achieve remote code execution. Developers using this library in Django projects should update to the latest version or manually secure the upload routes immediately.
Severidad
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:LCWE-306EPSS
Afecta
pylixm:django-mdeditorDescripción técnica
All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload malicious files and achieve arbitrary code execution since this endpoint lacks authentication protection and proper sanitisation of file names.
Referencias
- https://github.com/pylixm/django-mdeditor/blob/e8dd73fb8571ddff2e7a20a4bfa88c376cc33b62/mdeditor/views.py%23L25
- https://github.com/pylixm/django-mdeditor/commit/3e80f9edcabc5d2fc136b05a501964b8a5e97cfe
- https://github.com/pylixm/django-mdeditor/issues/151
- https://github.com/pylixm/django-mdeditor/pull/185
- https://security.snyk.io/vuln/SNYK-PYTHON-DJANGOMDEDITOR-8630926