This vulnerability allows an attacker to upload files to the image upload endpoint of django-mdeditor without any authentication checks or proper sanitization. As a result, an attacker can upload malicious files that may be executed or processed by the application, leading to arbitrary code execution. The weakness is identified as Missing Authentication for a Critical Function (CWE-306).

All published releases of the django-mdeditor package, which is commonly used as a Markdown editor for Django projects, are affected. No specific version boundaries are given; therefore any installation of django-mdeditor should be considered potentially vulnerable.

The CVSS score of 5.1 indicates a medium severity risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, via the web‑based image upload endpoint that accepts user‑supplied files. An attacker who can reach the upload URL does not need credentials to exploit the flaw.