CVE-2025-55746
CRITICALDirectus <11.9.3 - File Upload
Title source: llmDescription
Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents (without changes being applied to the files' database-resident metadata) and / or upload new files, with arbitrary content and extensions, which won't show up in the Directus UI. This vulnerability is fixed in 11.9.3.
Exploits (1)
Scores
CVSS v3
9.3
EPSS
0.0007
EPSS Percentile
22.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L
Details
CWE
CWE-434
CWE-73
Status
published
Products (3)
directus/api
14.1.0 - 28.0.2npm
monospace/directus
10.8.0 - 11.9.3
npm/directus
10.8.0 - 11.9.3npm
Published
Aug 20, 2025
Tracked Since
Feb 18, 2026