Critical · published August 20, 2025
🚨 An unauthenticated user can upload any file they want! The file update mechanism in Directus versions 10.8.0 to before 11.9.3 is like a vending machine that dispenses anything without checking your coins. 🔥 Imagine an open gallery where anyone can hang their artworks without any approval. You could have troll art next to masterpieces—an absolute mess that confuses and undermines the entire exhibit! This vulnerability could lead to malicious actors uploading harmful files that might not show up in the Directus UI, allowing them to manipulate your server’s content without any oversight. An attacker could effectively plant rogue files that could compromise your entire application, leading to absolute chaos.
Imagine an open gallery where anyone can hang their artworks without any approval. You could have troll art next to masterpieces—an absolute mess that confuses and undermines the entire exhibit! This vulnerability allows unauthenticated users to modify existing files or upload new ones with arbitrary content and extensions, without any changes being reflected in the database metadata, severely undermining content integrity.
This vulnerability could lead to malicious actors uploading harmful files that might not show up in the Directus UI, allowing them to manipulate your server’s content without any oversight. An attacker could effectively plant rogue files that could compromise your entire application, leading to absolute chaos. Immediately upgrade to Directus version 11.9.3 or higher to patch this vulnerability. Conduct a security review of your Directus setup to ensure no unauthorized files have already been uploaded. Strengthen your API access controls to limit file updates to authenticated users only. You've got this! With these steps, you can secure your application and keep it safe from unwanted chaos. 🛡️