GHSA-qp2c-xqv6-phh6

Suggest an improvement
Source
https://github.com/advisories/GHSA-qp2c-xqv6-phh6
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-qp2c-xqv6-phh6/GHSA-qp2c-xqv6-phh6.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-qp2c-xqv6-phh6
Aliases
  • CVE-2025-13030
Published
2026-04-30T06:30:30Z
Modified
2026-05-06T23:49:35.877177Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L CVSS Calculator
  • 2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:P CVSS Calculator
Summary
django-mdeditor is Missing Authentication for Critical Function
Details

All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload malicious files and achieve arbitrary code execution since this endpoint lacks authentication protection and proper sanitisation of file names.

Database specific 
{
    "github_reviewed_at": "2026-05-06T23:41:03Z",
    "github_reviewed": true,
    "severity": "LOW",
    "nvd_published_at": "2026-04-30T06:16:14Z",
    "cwe_ids": [
        "CWE-306"
    ]
}
References

Affected packages

PyPI / django-mdeditor

Package

Name
django-mdeditor
View open source insights on deps.dev
Purl
pkg:pypi/django-mdeditor

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
0.1.20

Affected versions

0.*
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.1.10
0.1.12
0.1.13
0.1.14
0.1.15
0.1.16
0.1.17.1
0.1.18
0.1.20

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-qp2c-xqv6-phh6/GHSA-qp2c-xqv6-phh6.json"