Executive brief
Directus is a headless CMS that manages digital assets and content for web applications. An unauthenticated attacker can upload new files or modify existing files through the /files API endpoint by manipulating unsanitized filename parameters, potentially enabling phishing attacks, malware distribution, or code execution if files are served directly by a web server.
Technical details
The vulnerability resides in the file update mechanism exposed via the /files route, where the filename_disk parameter is never sanitized. An attacker can pass path traversal sequences (../) or manipulate filenames to bypass the temp_ prefix. While the local storage driver's path normalization prevents arbitrary directory traversal, an attacker with knowledge of a valid file UUID can modify its contents or create new arbitrarily-named files without database metadata updates. Exploitation requires network access and knowledge of at least one existing file UUID (readily obtainable by browsing a public-facing application). The attacker can then send a single HTTP request to upload/modify files. Files created this way remain invisible in the Directus UI but are accessible on disk, and if the server directly serves the upload directory, they become publicly accessible. Patch: 11.9.3 for affected versions >10.8.0.
Affected products
- Directus Directus >10.8.0, <11.9.3
Timeline
- 2025-08-20: disclosed
- 2025-08-20: advisory