CVE-2025-13030
critical
CVSS v3
9.8
CVSS v2
—
VIR risk
9.8
Description
django-mdeditor is Missing Authentication for Critical Function
Predictions
Exploit likelihood
97%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: report@snyk.io — https://github.com/pylixm/django-mdeditor/commit/3e80f9edcabc5d2fc136b05a501964b8a5e97cfe
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| PyPI | django-mdeditor | <=0.1.20 | |
| PIP | django-mdeditor | <= 0.1.20 | |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| pylixm | django-mdeditor | | |
References
- https://github.com/pylixm/django-mdeditor/blob/e8dd73fb8571ddff2e7a20a4bfa88c376cc33b62/mdeditor/views.py%23L25
- https://github.com/pylixm/django-mdeditor/commit/3e80f9edcabc5d2fc136b05a501964b8a5e97cfe
- https://github.com/pylixm/django-mdeditor/issues/151
- https://github.com/pylixm/django-mdeditor/pull/185
- https://security.snyk.io/vuln/SNYK-PYTHON-DJANGOMDEDITOR-8630926
- https://nvd.nist.gov/vuln/detail/CVE-2025-13030
- https://github.com/pylixm/django-mdeditor
- https://github.com/advisories/GHSA-qp2c-xqv6-phh6
CWEs
CWE-306
Verify integrity in audit chain (admin only). AS-IS.