CVE-2026-39942CWE-284CWE-639

Directus has a Path Traversal and Broken Access Control in File Management API

High · published April 9, 2026

CVSS v3.1
8.5
EPSS
0%
Percentile
28.6
In the wild
Unconfirmed
What it is

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, the PATCH /files/{id} endpoint accepts a user-controlled filename_disk parameter. By setting this value to match the storage path of another user's file, an attacker can overwrite that file's content while manipulating metadata fields such as uploaded_by to obscure the tampering. This vulnerability is fixed in 11.17.0.

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00361 · 28.6th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-04-09T16:07Z
EPSS history
Timeline
  • 09 APR 16:07Z
    Directus has a Path Traversal and Broken Access Control in File Management API
    cvelistv5