Is CVE-2026-39942 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39942 being exploited in the wild.

How severe is CVE-2026-39942?

Low severity, with a CVSS score of 3.1, published 4 April 2026.

Which products and versions are affected?

directus (npm) SEMVER:introduced=0,fixed=11.17.0.

Is there a fix for CVE-2026-39942?

Yes. directus (npm): upgrade to 11.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39942 attacked?

It is attacked over the network.

Am I affected by CVE-2026-39942?

Check whether you run directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39942: Directus broken access control in file management API

CVE-2026-39942 · Severity: low · CVSS 3.1 · Published 2026-04-04

Directus is a flexible backend and headless CMS platform that manages files and content through an API. An authenticated user can manipulate the file management API to overwrite files belonging to other users or inject malicious code into shared storage, potentially leading to data corruption or remote code execution across the platform.

Technologies: directus (npm). Vendors: npm.

Quick answers

Is CVE-2026-39942 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39942 being exploited in the wild.
How severe is CVE-2026-39942?: Low severity, with a CVSS score of 3.1, published 4 April 2026.
Which products and versions are affected?: directus (npm) SEMVER:introduced=0,fixed=11.17.0.
Is there a fix for CVE-2026-39942?: Yes. directus (npm): upgrade to 11.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39942 attacked?: It is attacked over the network.
Am I affected by CVE-2026-39942?: Check whether you run directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

directus (npm): upgrade to 11.17.0 or later
```
npm install directus@11.17.0
```

Technical details

The vulnerability is a broken access control (CWE-284, CWE-639) issue in the file management API. The PATCH /files/{id} endpoint accepts user-controlled filename_disk parameter without proper server-side validation. An authenticated attacker can set this parameter to match the storage path of another user's file to overwrite it, and simultaneously manipulate metadata fields such as uploaded_by to obscure tampering. If the storage backend is shared with the extensions directory, attackers can deploy malicious extensions that execute arbitrary code upon loading. The attack requires authentication but no further user interaction; network reachability is required. Patches are available in version 11.17.0 and later.

Affected products

Directus directus < 11.17.0

Identifiers

CVE-2026-39942
GHSA-393c-p46r-7c95

Timeline

2026-04-02: disclosed
2026-03-24: patched: Version 11.17.0 released
2026-04-04: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.