CVE-2025-55746

The vulnerability stems from improper file path validation (CWE-73) and lack of verification of uploaded file types (CWE-434) in the Directus file update mechanism. An unauthorized actor can modify the content of existing files on the server without updating associated metadata in the database — which makes it difficult to detect tampering. Additionally, it is possible to upload completely new files with arbitrary extensions and content, which are not visible in the Directus UI interface, further masking the attacker's activity.

An attacker can overwrite the content of any files on the server or place new files with potentially malicious content (e.g., webshell), which can lead to compromise of application integrity, server-side code execution, or persistent foothold in the system.

Directus should be updated immediately to version 11.9.3 or newer, in which the vulnerability has been fixed. Details of the patch are available in the official security advisory from the vendor and in the GitHub repository of the project.

Monospace Directus in versions from 10.8.0 to before 11.9.3