All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload …

All versions of the django-mdeditor package are vulnerable to missing authentication for critical function in the image upload endpoint. The vulnerability allows attackers to upload malicious files without authentication and achieve arbitrary code execution. The endpoint lacks proper authentication protection and file name sanitization. This affects all versions of the package and has been assigned CVE-2025-13030. The vulnerability enables remote code execution through malicious file uploads.