All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload …

All versions of django-mdeditor package contain a critical vulnerability (CVE-2025-13030) in the image upload endpoint. The vulnerability allows attackers to upload malicious files and achieve arbitrary code execution due to missing authentication protection and improper file name sanitization. This affects all versions of the package and poses a high security risk for applications using django-mdeditor.