{"id":"CVE-2026-39942","aliases":["GHSA-393c-p46r-7c95"],"url":"https://o3.security/vulnerability/CVE-2026-39942","summary":"Directus has a Path Traversal and Broken Access Control in File Management API","details":"## Summary\n\nA broken access control vulnerability was identified in the Directus file management API that allows authenticated users to overwrite files belonging to other users by manipulating the `filename_disk` parameter.\n\n## Details\n\nThe `PATCH /files/{id}` endpoint accepts a user-controlled `filename_disk` parameter. By setting this value to match the storage path of another user's file, an attacker can overwrite that file's content while manipulating metadata fields such as `uploaded_by` to obscure the tampering.\n\n## Impact\n\n- **Unauthorized File Overwrite**: Attackers can replace legitimate files with malicious content, creating significant risk of malware propagation and data corruption.\n- **Remote Code Execution**: If the storage backend is shared with the extensions location, attackers can deploy malicious extensions that execute arbitrary code when loaded.\n- **Data Integrity Compromise**: Files can be tampered with or replaced without visible indication in the application interface.\n\n## Mitigation\n\nThe `filename_disk` parameter should be treated as a server-controlled value. Uniqueness of storage paths must be enforced server-side, and `filename_disk` should be excluded from the fields users are permitted to update directly.","published":"2026-04-09T16:07:54.100Z","modified":"2026-08-12T03:51:39.208808440Z","cvss":{"score":8.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N"},"epss":{"score":0.00204,"percentile":0.10662,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"directus","fixedVersion":"11.17.0"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/directus/directus/releases/tag/v11.17.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39942.json"},{"type":"ADVISORY","url":"https://github.com/directus/directus/security/advisories/GHSA-393c-p46r-7c95"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39942"},{"type":"PACKAGE","url":"https://github.com/directus/directus"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:39.208808440Z"}}