P4Verified

CVE-2025-13030: django-mdeditor 0 to before *

CVE-2025-13030. CVSS 3.1 base score 9.8 (CRITICAL, NVD). EPSS 0.00308 (percentile 0.21917), scored 13-Oct-2026.

Affected technology

django-mdeditor · 0 to before *
pylixm

Description’s affected range: versions of the package django-mdeditor

Component: Not specified by the source
Function: in

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · Active user interaction

What an attacker can do

An attacker can upload malicious files and achieve arbitrary code execution since this endpoint lacks authentication protection and proper sanitisation of file names. Vendor/CNA’s CVSS 4.0 assessment (base score 2.0/10) rates confidentiality and availability impact as none; integrity impact as low.

Published 14-Oct-2026 15:58 UTC

CWE: CWE-306
CCR priority: 39.3 /100 (P4)
CVSS 3.1: 9.8 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · NVD
EPSS: 0.00308 · percentile 0.21917 · 2026-10-13
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-14 15:56:36.793806+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2025-13030.html