CVE-2025-55746

Directus allows unauthenticated file upload and file modification due to lacking input sanitization

State: Published
Severity: 9.3 Critical
Published: Aug 20, 2025
Updated: Aug 20, 2025
Reserved: Aug 14, 2025

Description

Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents (without changes being applied to the files' database-resident metadata) and / or upload new files, with arbitrary content and extensions, which won't show up in the Directus UI. This vulnerability is fixed in 11.9.3.

Scores

CVSS	Score	Vector	Source
3.1	9.3 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L	GitHub_M

Weaknesses

CWE-73 External Control of File Name or Path
CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
directusdirectus	>= 10.8.0, < 11.9.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.