CVE-2026-39942 - Vulnerability Analysis

Overview

Directus < 11.17.0 contains a file overwrite vulnerability caused by insufficient validation of the filename_disk parameter in PATCH /files/{id} endpoint, letting attackers overwrite other users' files and manipulate metadata, exploit requires crafted request with specific filename_disk value.

Severity & Score

Impact

Attackers can overwrite other users' files and manipulate metadata, leading to data tampering and potential information loss.

Mitigation

Update to version 11.17.0 or later.

References

• https://github.com/directus/directus/releases/tag/v11.17.0
• https://github.com/directus/directus/security/advisories/GHSA-393c-p46r-7c95

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner