← Back

CVE-2025-13030

nvd nist
Published: Apr 30, 2026Modified: Jun 17, 2026

JSON object

Loading...
2.0
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: report@snyk.io (Secondary)

Description

All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload malicious files and achieve arbitrary code execution since this endpoint lacks authentication protection and proper sanitisation of file names.

Affected (1)

Pylixm
1 product
Django Mdeditor
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Django Mdeditor
All versions

Related CWEs

CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (5)

Source: report@snyk.io
Broken Link
Source: report@snyk.io
Patch
Source: report@snyk.io
Issue Tracking
Source: report@snyk.io
Issue Tracking
Source: report@snyk.io
Third Party Advisory

Timeline

No history available yet.