CVE-2019-13981

In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads/_/originals/ directory

published July 19, 2019

CVSS
—
EPSS
2%
Percentile
74.1
In the wild
Unconfirmed
What it is

In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads/_/originals/ directory. This is related to a configuration option in which the file collection can be non-public, but this option does not apply to the thumbnailer.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01500 · 74.1th percentile
Published
2019-07-19T14:17Z
EPSS history
Timeline
  • 19 JUL 14:17Z
    In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads/_/originals/ directory
    cvelistv5