CVE-2021-29641

Directus 8 before 8.8.2 allows remote authenticated users to execute arbitrary code because file-upload permissions include the ability to upload a .php file…

published April 7, 2021

CVSS
—
EPSS
5%
Percentile
92.0
In the wild
Unconfirmed
What it is

Directus 8 before 8.8.2 allows remote authenticated users to execute arbitrary code because file-upload permissions include the ability to upload a .php file to the main upload directory and/or upload a .php file and a .htaccess file to a subdirectory. Exploitation succeeds only for certain installations with the Apache HTTP Server and the local-storage driver (e.g., when the product was obtained from hub.docker.com).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04867 · 92.0th percentile
Published
2021-04-07T21:31Z
EPSS history
Timeline
  • 07 APR 21:31Z
    Directus 8 before 8.8.2 allows remote authenticated users to execute arbitrary code because file-upload permissions include the ability to upload a .php file…
    cvelistv5