django-mdeditor versions up to 0.1.20 have a vulnerability in the image upload endpoint due to missing authentication. This allows unauthenticated attackers to upload malicious files, potentially leading to arbitrary code execution. The flaw arises from lack of authentication and insufficient sanitization of file names in the upload functionality.