https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 05:41:06 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-232648 EUVD-2026-232648 https://cve.radiocsirt.org/vuln/euvd-2026-232648 https://cve.radiocsirt.org/vuln/fkie_cve-2022-36031 <p>Directus is a free and open-source data platform for headless content management. The Directus process can be aborted by having an authorized user update the `filename_disk` value to a folder and accessing that file through the `/assets` endpoint. This vulnerability has been patched and release v9.15.0 contains the fix. Users are advised to upgrade. Users unable to upgrade may prevent this problem by making sure no (untrusted) non-admin users have permissions to update the `filename_disk` field on `directus_files`.</p> <p>Directus is a free and open-source data platform for headless content management. The Directus process can be aborted by having an authorized user update the `filename_disk` value to a folder and accessing that file through the `/assets` endpoint. This vulnerability has been patched and release v9.15.0 contains the fix. Users are advised to upgrade. Users unable to upgrade may prevent this problem by making sure no (untrusted) non-admin users have permissions to update the `filename_disk` field on `directus_files`.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-36031 https://cve.radiocsirt.org/vuln/ghsa-77qm-wvqq-fg79 <p><strong>Affected:</strong> npm: directus</p> <p>The Directus process can be aborted by having an authorized user update the `filename_disk` value to a folder and accessing that file through the `/assets` endpoint.</p> <p>The vulnerability is patched and released in v9.15.0.</p> <p>You can prevent this problem by making sure no (untrusted) non-admin users have permissions to update the `filename_disk` field on `directus_files`.</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory: * Open a Discussion in [directus/directus](https://github.com/directus/directus/discussions) * Email us at [security@directus.io](mailto:security@directus.io)</p> <p>### Credits</p> <p>This vulnerability was first discovered and reported by Witold Gorecki.</p> <p><strong>Affected:</strong> npm: directus</p> <p>The Directus process can be aborted by having an authorized user update the `filename_disk` value to a folder and accessing that file through the `/assets` endpoint.</p> <p>The vulnerability is patched and released in v9.15.0.</p> <p>You can prevent this problem by making sure no (untrusted) non-admin users have permissions to update the `filename_disk` field on `directus_files`.</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory: * Open a Discussion in [directus/directus](https://github.com/directus/directus/discussions) * Email us at [security@directus.io](mailto:security@directus.io)</p> <p>### Credits</p> <p>This vulnerability was first discovered and reported by Witold Gorecki.</p> https://cve.radiocsirt.org/vuln/ghsa-77qm-wvqq-fg79 https://cve.radiocsirt.org/vuln/gsd-2022-36031 gsd-2022-36031 https://cve.radiocsirt.org/vuln/gsd-2022-36031