github.com
https://github.com/directus/directus CVE-2026-39942
HIGH
Directus has a Path Traversal and Broken Access Control in File Management API
Record summary
CVE-2026-39942 has a selected CVSS score of 8.5 (high).
Description
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, the PATCH /files/{id} endpoint accepts a user-controlled filename_disk parameter. By setting this value to match the storage path of another user's file, an attacker can overwrite that file's content while manipulating metadata fields such as uploaded_by to obscure the tampering. This vulnerability is fixed in 11.17.0.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 9, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
directusBrowse directus / directus | CVE List | < 11.17.0 | affected |
directusBrowse npm / directus | GitHub Advisory | Before 11.17.0 · Fixed in 11.17.0 | affected |
References
4github.com
https://github.com/directus/directus/releases/tag/v11.17.0 github.comConfirmation
https://github.com/directus/directus/security/advisories/GHSA-393c-p46r-7c95 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-39942