PT-2026-31648 · Directus · Directus

Odgrso + 2 · Published 2026-04-04 · Updated 2026-04-09 · CVE-2026-39942

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.17.0

Description The Directus file management API contains a broken access control issue that allows authenticated users to overwrite files belonging to other users by manipulating the filename disk parameter in the PATCH /files/{id} endpoint. By setting this value to match the storage path of another user's file, an attacker can overwrite the file's content and manipulate metadata fields like uploaded by to hide the tampering. This can lead to unauthorized file overwrites, potential remote code execution if the storage backend is shared with the extensions location, and data integrity compromise.

Recommendations Update to version 11.17.0 or later.

Fix

Improper Access Control

IDOR

Weakness Enumeration

CWE-915

CWE-284

CWE-639

Related Identifiers

CVE-2026-39942

GHSA-393C-P46R-7C95

Affected Products

Directus

References · 7

• https://github.com/directus/directus/security/advisories/GHSA-393c-p46r-7c95 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39942 · Security Note
• https://osv.dev/vulnerability/GHSA-393c-p46r-7c95 · Vendor Advisory
• https://github.com/directus/directus · Note
• https://github.com/directus/directus/releases/tag/v11.17.0 · Note
• https://twitter.com/CVEnew/status/2042302800034742696 · Twitter Post
• https://twitter.com/CveFindCom/status/2042297266208116748 · Twitter Post