PT-2026-30329 · Directus · Directus

Bugbunny-Research · Published 2026-04-04 · Updated 2026-04-06 · CVE-2026-35412

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.16.1

Description Directus' TUS resumable upload endpoint (/files/tus) allows any authenticated user with basic file upload permissions to overwrite arbitrary existing files by UUID. The TUS controller performs only collection-level authorization checks on directus files, but does not validate item-level access to the specific file being replaced. This bypasses row-level permission rules. As a result, an attacker can overwrite any file in directus files by UUID, leading to potential data loss and metadata corruption. Privilege escalation is possible if admin-owned files are stored in directus files.

Recommendations Update to version 11.16.1 or later. As a workaround, disable TUS uploads by setting TUS ENABLED=false if resumable uploads are not required.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-35412

GHSA-QQMV-5P3G-PX89

Affected Products

Directus

References · 5

• https://github.com/directus/directus/security/advisories/GHSA-qqmv-5p3g-px89 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35412 · Security Note
• https://osv.dev/vulnerability/GHSA-qqmv-5p3g-px89 · Vendor Advisory
• https://github.com/directus/directus · Note
• https://twitter.com/CVEnew/status/2041282871814693038 · Twitter Post