CVE-2025-55746: Directus unauthenticated file upload and modification

CVE-2025-55746 · Severity: low · CVSS 3.1 · Published 2025-08-20

Directus is a headless CMS that manages digital assets and content for web applications. An unauthenticated attacker can upload new files or modify existing files through the /files API endpoint by manipulating unsanitized filename parameters, potentially enabling phishing attacks, malware distribution, or code execution if files are served directly by a web server.

Technologies: @directus/api (npm), directus (npm). Vendors: npm.

Quick answers

Is CVE-2025-55746 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-55746 being exploited in the wild.
How severe is CVE-2025-55746?
Low severity, with a CVSS score of 3.1, published 20 August 2025.
Which products and versions are affected?
@directus/api (npm) SEMVER:introduced=14.1.0,fixed=28.0.2; directus (npm) SEMVER:introduced=10.8.0,fixed=11.9.3.
Is there a fix for CVE-2025-55746?
Yes. @directus/api (npm): upgrade to 28.0.2 or later; directus (npm): upgrade to 11.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-55746 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2025-55746?
Check whether you run @directus/api (npm) or directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @directus/api (npm): upgrade to 28.0.2 or later
    npm install @directus/api@28.0.2
  • directus (npm): upgrade to 11.9.3 or later
    npm install directus@11.9.3

Technical details

The vulnerability resides in the file update mechanism exposed via the /files route, where the filename_disk parameter is never sanitized. An attacker can pass path traversal sequences (../) or manipulate filenames to bypass the temp_ prefix. While the local storage driver's path normalization prevents arbitrary directory traversal, an attacker with knowledge of a valid file UUID can modify its contents or create new arbitrarily-named files without database metadata updates. Exploitation requires network access and knowledge of at least one existing file UUID (readily obtainable by browsing a public-facing application). The attacker can then send a single HTTP request to upload/modify files. Files created this way remain invisible in the Directus UI but are accessible on disk, and if the server directly serves the upload directory, they become publicly accessible. Patch: 11.9.3 for affected versions >10.8.0.

Affected products

  • Directus Directus >10.8.0, <11.9.3

Identifiers

  • CVE-2025-55746
  • GHSA-mv33-9f6j-pfmc

Timeline

  • 2025-08-20: disclosed
  • 2025-08-20: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.