Executive brief
Directus is a flexible backend and headless CMS platform that manages files and content through an API. An authenticated user can manipulate the file management API to overwrite files belonging to other users or inject malicious code into shared storage, potentially leading to data corruption or remote code execution across the platform.
Technical details
The vulnerability is a broken access control (CWE-284, CWE-639) issue in the file management API. The PATCH /files/{id} endpoint accepts user-controlled filename_disk parameter without proper server-side validation. An authenticated attacker can set this parameter to match the storage path of another user's file to overwrite it, and simultaneously manipulate metadata fields such as uploaded_by to obscure tampering. If the storage backend is shared with the extensions directory, attackers can deploy malicious extensions that execute arbitrary code upon loading. The attack requires authentication but no further user interaction; network reachability is required. Patches are available in version 11.17.0 and later.
Affected products
- Directus directus < 11.17.0
Timeline
- 2026-04-02: disclosed
- 2026-03-24: patched: Version 11.17.0 released
- 2026-04-04: advisory