# CVE-2026-39942: Directus broken access control in file management API

Source: https://junglewise.ai/threats/cve-2026-39942-directus-path-traversal-and-broken-access-control-in-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-39942 · Severity: low · CVSS 3.1 · Published 2026-04-04

Directus is a flexible backend and headless CMS platform that manages files and content through an API. An authenticated user can manipulate the file management API to overwrite files belonging to other users or inject malicious code into shared storage, potentially leading to data corruption or remote code execution across the platform.

Technologies: [directus (npm)](https://junglewise.ai/threats/technologies/directus). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-39942 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39942 being exploited in the wild.

**How severe is CVE-2026-39942?** Low severity, with a CVSS score of 3.1, published 4 April 2026.

**Which products and versions are affected?** directus (npm) SEMVER:introduced=0,fixed=11.17.0.

**Is there a fix for CVE-2026-39942?** Yes. directus (npm): upgrade to 11.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39942 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-39942?** Check whether you run directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- directus (npm): upgrade to 11.17.0 or later

  ```sh
  npm install directus@11.17.0
  ```


## Technical details

The vulnerability is a broken access control (CWE-284, CWE-639) issue in the file management API. The PATCH /files/{id} endpoint accepts user-controlled filename_disk parameter without proper server-side validation. An authenticated attacker can set this parameter to match the storage path of another user's file to overwrite it, and simultaneously manipulate metadata fields such as uploaded_by to obscure tampering. If the storage backend is shared with the extensions directory, attackers can deploy malicious extensions that execute arbitrary code upon loading. The attack requires authentication but no further user interaction; network reachability is required. Patches are available in version 11.17.0 and later.

## Affected products

- Directus directus < 11.17.0

## Identifiers

- CVE-2026-39942
- GHSA-393c-p46r-7c95

## Timeline

- 2026-04-02: disclosed
- 2026-03-24: patched: Version 11.17.0 released
- 2026-04-04: advisory

## References

- [https://github.com/directus/directus/security/advisories/GHSA-393c-p46r-7c95](https://github.com/directus/directus/security/advisories/GHSA-393c-p46r-7c95)
- [https://github.com/directus/directus](https://github.com/directus/directus)
- [https://github.com/directus/directus/releases/tag/v11.17.0](https://github.com/directus/directus/releases/tag/v11.17.0)

## Related threats

- [Directus authorization bypass via unsegmented response cache key](https://junglewise.ai/threats/cve-2026-61836-directus-authorization-bypass-via-unsegmented-response-cache-key)
- [Directus SSRF bypass in file import via 0.0.0.0 address](https://junglewise.ai/threats/cve-2026-61835-directus-ssrf-bypass-in-file-import-via-0-0-0-0-address)
- [Directus sensitive information disclosure via aggregate queries](https://junglewise.ai/threats/cve-2026-35442-directus-sensitive-information-disclosure-via-aggregate-queries)
- [Directus resource exhaustion via GraphQL alias amplification](https://junglewise.ai/threats/cve-2026-35441-directus-resource-exhaustion-via-graphql-alias-amplification)
- [Directus GraphQL introspection bypass in system endpoint](https://junglewise.ai/threats/cve-2026-35413-directus-graphql-introspection-bypass-in-system-endpoint)