/Vulnerability Library

Directus - Unauthenticated File Modification

CVE-2025-55746
Verified

Description

Directus versions from 10.8.0 before 11.9.3 allow unauthenticated attackers to modify the contents of an existing file when a valid file UUID is known. The PATCH /files/{id} endpoint processes multipart file uploads without proper authentication, allowing file content replacement despite returning a 403 status code. This template requires a known, controlled Directus file UUID provided via the file_id variable.

Severity

Critical

CVSS Score

9.3

Exploit Probability

1%

Affected Product

directus

Published Date

May 16, 2026

Template Author

aleff-github

CVE-2025-55746.yaml
9.3Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L
CVE ID:
cve-2025-55746
CWE ID:
cwe-73

References

https://github.com/advisories/GHSA-mv33-9f6j-pfmchttps://github.com/directus/directus/commit/d84dcc36f75fc5c858d43746b8f9c426c38d696bhttps://nvd.nist.gov/vuln/detail/CVE-2025-55746

Remediation Steps

Upgrade Directus to version 11.9.3 or later.