CVE-2025-55746
published 2025-08-20CVE-2025-55746: Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update…
PriorityP352high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
0.44%
35.0th percentile
Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents (without changes being applied to the files' database-resident metadata) and / or upload new files, with arbitrary content and extensions, which won't show up in the Directus UI. This vulnerability is fixed in 11.9.3.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| directus | api | >= 14.1.0 < 28.0.2 | 28.0.2 |
| directus | directus | — | — |
| directus | directus | >= 10.8.0 < 11.9.3 | 11.9.3 |
| monospace | directus | >= 10.8.0 < 11.9.3 | 11.9.3 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Directus allows unauthenticated file upload and file modification due to lacking input sanitization
ghsa·2025-08-20
CVE-2025-55746 [CRITICAL] CWE-73 Directus allows unauthenticated file upload and file modification due to lacking input sanitization
Directus allows unauthenticated file upload and file modification due to lacking input sanitization
## Summary
A vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents (without changes being applied to the files' database-resident metadata) and / or upload new files, with arbitrary content and extensions, which won't show up in the Directus UI.
## Details
Directus exposes the CRUD operations for uploading or handling files under the `/files` route.
The endpoint handler is responsible for updating an existing file identified by the provided primary key specified through the `pk` parameter. Primary keys are UUID values such as `/files/927b3abf-fb4b-4c66-bdaa-eb7dc48a51cb`. Here the `filename_disk` value is
OSV
Directus allows unauthenticated file upload and file modification due to lacking input sanitization
osv·2025-08-20
CVE-2025-55746 [CRITICAL] Directus allows unauthenticated file upload and file modification due to lacking input sanitization
Directus allows unauthenticated file upload and file modification due to lacking input sanitization
## Summary
A vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents (without changes being applied to the files' database-resident metadata) and / or upload new files, with arbitrary content and extensions, which won't show up in the Directus UI.
## Details
Directus exposes the CRUD operations for uploading or handling files under the `/files` route.
The endpoint handler is responsible for updating an existing file identified by the provided primary key specified through the `pk` parameter. Primary keys are UUID values such as `/files/927b3abf-fb4b-4c66-bdaa-eb7dc48a51cb`. Here the `filename_disk` value is
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-08-20
Published