CVE-2025-13030 is a vulnerability in django-mdeditor where the image upload endpoint does not enforce authentication, enabling attackers to upload malicious files. The absence of proper file name sanitization further increases the risk, potentially allowing arbitrary code execution. This affects all versions of the package. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

An attacker can exploit the missing authentication on the image upload endpoint to upload malicious files. Due to inadequate sanitization of file names, this can result in arbitrary code execution on the affected system. This could compromise the integrity and security of applications using django-mdeditor.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the image upload endpoint through external means such as network controls or application-level authentication proxies. Avoid exposing the vulnerable endpoint publicly and monitor for any unusual activity related to file uploads.