CVE-2025-55746: Directus Unauthenticated File Upload and Modification Vulnerability
Summary
CVE-2025-55746: Directus allows unauthenticated file upload and file modification due to lacking input sanitization. Affects directus versions >= 10.8.0, < 11.9.3. Fixed in 11.9.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Directus is an open-source headless CMS that provides a powerful API for managing content and files. It allows users to create, manage, and deliver content across various platforms. However, a critical vulnerability has been identified in its file update mechanism, which exposes the system to unauthorized file modifications and uploads.
Vulnerability Detail
The vulnerability arises from a lack of input sanitization in the file update mechanism of Directus. An unauthenticated actor can exploit this flaw to modify existing files or upload new files with arbitrary content and extensions. The primary key, which is a UUID, is required for exploitation, allowing attackers to change file contents without altering the associated metadata. This can lead to serious consequences, including unauthorized access to sensitive information, phishing attacks, and the potential for code execution if the server serves files directly from the upload directory.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.9.3
This is the first release that contains the fix.
npm install directus@11.9.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the '/files' route and ensure that the server does not serve files directly from the upload directory. Implement additional security measures, such as validating file types and sanitizing file names before processing uploads.
Conclusion
The CVE-2025-55746 vulnerability in Directus poses significant risks due to its ability to allow unauthorized file uploads and modifications. It is crucial for users to update to the patched versions and implement recommended security practices to safeguard their systems.
See every vulnerability recorded for directus →
FAQ
CVE-2025-55746 is a critical vulnerability in Directus that allows unauthenticated users to upload and modify files without proper authorization.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
The impacts include unauthorized file modifications, potential phishing attacks, and the risk of code execution if files are served directly from the upload directory.
Restrict access to the vulnerable routes and implement strict validation and sanitization of file uploads as a temporary measure.
The CVSS score of this vulnerability is 9.3, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for directus.
