GHSA-393c-p46r-7c95 CVE-2026-39942
Directus: Path Traversal and Broken Access Control in File Management API
- Severity
- 8.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.20%
- Chance of exploitation in the next 30 days. Higher than 10.42% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-284 Improper Access Control
- CWE-639 Authorization Bypass Through User-Controlled Key
- CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
- Fix
11.17.0- Upgrade directus to this version or later
Description
Summary
A broken access control vulnerability was identified in the Directus file management API that allows authenticated users to overwrite files belonging to other users by manipulating the filename_disk parameter.
Details
The PATCH /files/{id} endpoint accepts a user-controlled filename_disk parameter. By setting this value to match the storage path of another user's file, an attacker can overwrite that file's content while manipulating metadata fields such as uploaded_by to obscure the tampering.
Impact
- Unauthorized File Overwrite: Attackers can replace legitimate files with malicious content, creating significant risk of malware propagation and data corruption.
- Remote Code Execution: If the storage backend is shared with the extensions location, attackers can deploy malicious extensions that execute arbitrary code when loaded.
- Data Integrity Compromise: Files can be tampered with or replaced without visible indication in the application interface.
Mitigation
The filename_disk parameter should be treated as a server-controlled value. Uniqueness of storage paths must be enforced server-side, and filename_disk should be excluded from the fields users are permitted to update directly.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| directus | < 11.17.0 |
11.17.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
directus npm → 11.17.0
- npm
npm install directus@11.17.0- yarn
yarn add directus@11.17.0- pnpm
pnpm add directus@11.17.0
Severity breakdown
CVSS 3.1 8.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- High
- Availability
- None
Weakness
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it
- Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
CWE-639: Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
How to prevent it
- Architecture and Design: For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
- Architecture and Design, Implementation: Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
- Architecture and Design: Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
How to prevent it
- Implementation: If available, use features of the language or framework that allow specification of allowlists of attributes or fields that are allowed to be modified. If possible, prefer allowlists over denylists. For applications written with Ruby on Rails, use the attr_accessible (allowlist) or attr_protected (denylist) macros in each class that may be used in mass assignment.
- Architecture and Design, Implementation: If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
- Implementation: For any externally-influenced input, check the input against an allowlist of internal object attributes or fields that are allowed to be modified.
- Implementation, Architecture and Design: Refactor the code so that object attributes or fields do not need to be dynamically identified, and only expose getter/setter functionality for the intended attributes.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-c6w9-5g5j-jh2p Directus: Authorization-dependent response served from unsegmented cache key | High | Also affects directus |
| GHSA-j5h6-vqc3-phqh Directus: SSRF Protection Bypass via 0.0.0.0 in File Import | High | Also affects directus |
| GHSA-38hg-ww64-rrwc Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries | High | Also affects directus |
| GHSA-6q22-g298-grjh Directus: Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check Resolver | High | Also affects directus |
| GHSA-ph52-67fq-75wj Directus: GraphQL Alias Amplification Denial of Service Due to Missing Query Cost/Complexity Limits | Medium | Also affects directus |
| GHSA-mvv8-v4jj-g47j Directus: Sensitive fields exposed in revision history | Medium | Also affects directus |
| GHSA-qqmv-5p3g-px89 Directus: TUS Upload Authorization Bypass Allows Arbitrary File Overwrite | High | Also affects directus |
| GHSA-wv3h-5fx7-966h Directus: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import | High | Also affects directus |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor