CRITICAL🇵🇱 Wersja polska

CVE-2025-55746

CVSS 9.3v3.1pub. 2025-08-20upd. 2026-01-13

Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents (without changes being applied to the files' database-resident metadata) and / or upload new files, with arbitrary content and extensions, which won't show up in the Directus UI. This vulnerability is fixed in 11.9.3.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L

  • Monospace Directus

    APP
    Monospace
    10.8.0 – 11.9.3 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2022-26969CRITICAL9.8ten sam produkt

In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.

CVE-2026-39942HIGH8.5ten sam produkt

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, the PATCH /...

CVE-2026-35408HIGH8.7ten sam produkt

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus's ...

CVE-2026-35409HIGH7.7ten sam produkt

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.0, a Server-Si...

CVE-2026-35412HIGH7.1ten sam produkt

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus' T...