EUVD-2026-281107

fkie_cve-2026-35412

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus' TUS resumable upload endpoint (/files/tus) allows any authenticated user with basic file upload permissions to overwrite arbitrary existing files by UUID. The TUS controller performs only collection-level authorization checks, verifying the user has some permission on directus_files, but never validates item-level access to the specific file being replaced. As a result, row-level permission rules (e.g., "users can only update their own files") are completely bypassed via the TUS path while being correctly enforced on the standard REST upload path. This vulnerability is fixed in 11.16.1.

GHSA-qqmv-5p3g-px89 — Directus: TUS Upload Authorization Bypass Allows Arbitrary File Overwrite

Affected: npm: directus

## Summary

Directus' TUS resumable upload endpoint (`/files/tus`) allows any authenticated user with basic file upload permissions to overwrite arbitrary existing files by UUID. The TUS controller performs only collection-level authorization checks, verifying the user has some permission on `directus_files`, but never validates item-level access to the specific file being replaced. As a result, row-level permission rules (e.g., "users can only update their own files") are completely bypassed via the TUS path while being correctly enforced on the standard REST upload path.

## Impact

- **Arbitrary file overwrite:** Any authenticated user with basic TUS upload permissions can overwrite any file in `directus_files` by UUID, regardless of row-level permission rules. - **Permanent data loss:** The victim file's original stored bytes are deleted from storage and replaced with attacker-controlled content. - **Metadata corruption:** The victim file's database record is updated with the attacker's filename, type, and size metadata. Privilege escalation potential: If admin-owned files (e.g., application assets, templates) are stored in `directus_files`, a low-privilege user could replace them with malicious content.

## Workaround

Disable TUS uploads by setting `TUS_ENABLED=false` if resumable uploads are not required.

## Credit

This vulnerability was discovered and reported by [bugbunny.ai](https://bugbunny.ai).

Most recent entries from all

EUVD-2026-281107

fkie_cve-2026-35412

GHSA-qqmv-5p3g-px89 — Directus: TUS Upload Authorization Bypass Allows Arbitrary File Overwrite