PT-2025-34141 · Directus · Directus

R4Bbit-R4 · Published 2025-08-20 · Updated 2026-04-05 · CVE-2025-55746

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions: Directus versions 10.8.0 through 11.9.3

Description: Directus is a real-time API and App dashboard for managing SQL database content. A vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents (without changes being applied to the files' database-resident metadata) and / or upload new files, with arbitrary content and extensions, which won't show up in the Directus UI. This can lead to remote code execution if the server directly serves files from the upload directory. The vulnerability allows attackers to upload webshells, potentially gaining full control of the underlying server. The vulnerability requires knowledge of at least one file UUID to exploit. The impact can range from setting up phishing sites to poisoning hosted files and gaining access to internal services.

Recommendations: Apply the latest Directus security patch addressing this vulnerability. Enforce MIME-type and content validation. Restrict executable file types. Isolate Directus in containers or VMs and limit permissions on upload directories. Scan for existing webshells and audit logs for unusual upload activity.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

CWE-73

Related Identifiers

CVE-2025-55746

GHSA-MV33-9F6J-PFMC

Affected Products

Directus

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55746.json · Exploit
• https://github.com/directus/directus/security/advisories/GHSA-mv33-9f6j-pfmc · Vendor Advisory
• https://github.com/directus/directus/commit/d84dcc36f75fc5c858d43746b8f9c426c38d696b · Patch
• https://osv.dev/vulnerability/CVE-2025-55746 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55746 · Security Note
• https://osv.dev/vulnerability/GHSA-mv33-9f6j-pfmc · Vendor Advisory
• https://github.com/directus/directus · Note
• https://twitter.com/HunterMapping/status/1959804892408676459 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1n0hqrs/top_10_trending_cves_26082025 · Reddit Post
• https://reddit.com/r/CVEWatch/comments/1n1cwj2/top_10_trending_cves_27082025 · Reddit Post
• https://twitter.com/zoomeye_team/status/1958835045604761880 · Twitter Post
• https://twitter.com/dailycve/status/2040707620831387869 · Twitter Post
• https://twitter.com/HunterMapping/status/1959804974663442613 · Twitter Post
• https://twitter.com/4osp3l/status/2035868127032971669 · Twitter Post
• https://twitter.com/fofabot/status/1959931938443235570 · Twitter Post