Directus: Path Traversal and Broken Access Control in File Management API
Summary
A broken access control vulnerability was identified in the Directus file management API that allows authenticated users to overwrite files belonging to other users by manipulating the filename_disk parameter.
Details
The PATCH /files/{id} endpoint accepts a user-controlled filename_disk parameter. By setting this value to match the storage path of another user's file, an attacker can overwrite that file's content while manipulating metadata fields such as uploaded_by to obscure the tampering.
Impact
- Unauthorized File Overwrite: Attackers can replace legitimate files with malicious content, creating significant risk of malware propagation and data corruption.
- Remote Code Execution: If the storage backend is shared with the extensions location, attackers can deploy malicious extensions that execute arbitrary code when loaded.
- Data Integrity Compromise: Files can be tampered with or replaced without visible indication in the application interface.
Mitigation
The filename_disk parameter should be treated as a server-controlled value. Uniqueness of storage paths must be enforced server-side, and filename_disk should be excluded from the fields users are permitted to update directly.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | directus | < 11.17.0 | 11.17.0 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N- Weakness (CWE)
CWE-284, CWE-639, CWE-915- Platform
- npm
- Package
directus- Disclosed
- 04.04.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-393c-p46r-7c95 - CC BY 4.0
Vulnerability history: directus
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 58
- First → latest
- 04.2022 07.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 19
- Medium 34
- Low 3
Disclosures per year
- 2022: 4
- 2023: 8
- 2024: 14
- 2025: 17
- 2026: 15
-
Directus: Path Traversal and Broken Access Control in File Management API this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.