https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 12:37:56 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-290308 EUVD-2026-290308 https://cve.radiocsirt.org/vuln/euvd-2026-290308 https://cve.radiocsirt.org/vuln/fkie_cve-2026-39942 <p>Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, the PATCH /files/{id} endpoint accepts a user-controlled filename_disk parameter. By setting this value to match the storage path of another user&#39;s file, an attacker can overwrite that file&#39;s content while manipulating metadata fields such as uploaded_by to obscure the tampering. This vulnerability is fixed in 11.17.0.</p> <p>Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, the PATCH /files/{id} endpoint accepts a user-controlled filename_disk parameter. By setting this value to match the storage path of another user&#39;s file, an attacker can overwrite that file&#39;s content while manipulating metadata fields such as uploaded_by to obscure the tampering. This vulnerability is fixed in 11.17.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-39942 https://cve.radiocsirt.org/vuln/ghsa-393c-p46r-7c95 <p><strong>Affected:</strong> npm: directus</p> <p>## Summary</p> <p>A broken access control vulnerability was identified in the Directus file management API that allows authenticated users to overwrite files belonging to other users by manipulating the `filename_disk` parameter.</p> <p>## Details</p> <p>The `PATCH /files/{id}` endpoint accepts a user-controlled `filename_disk` parameter. By setting this value to match the storage path of another user&#39;s file, an attacker can overwrite that file&#39;s content while manipulating metadata fields such as `uploaded_by` to obscure the tampering.</p> <p>## Impact</p> <p>- **Unauthorized File Overwrite**: Attackers can replace legitimate files with malicious content, creating significant risk of malware propagation and data corruption. - **Remote Code Execution**: If the storage backend is shared with the extensions location, attackers can deploy malicious extensions that execute arbitrary code when loaded. - **Data Integrity Compromise**: Files can be tampered with or replaced without visible indication in the application interface.</p> <p>## Mitigation</p> <p>The `filename_disk` parameter should be treated as a server-controlled value. Uniqueness of storage paths must be enforced server-side, and `filename_disk` should be excluded from the fields users are permitted to update directly.</p> <p><strong>Affected:</strong> npm: directus</p> <p>## Summary</p> <p>A broken access control vulnerability was identified in the Directus file management API that allows authenticated users to overwrite files belonging to other users by manipulating the `filename_disk` parameter.</p> <p>## Details</p> <p>The `PATCH /files/{id}` endpoint accepts a user-controlled `filename_disk` parameter. By setting this value to match the storage path of another user&#39;s file, an attacker can overwrite that file&#39;s content while manipulating metadata fields such as `uploaded_by` to obscure the tampering.</p> <p>## Impact</p> <p>- **Unauthorized File Overwrite**: Attackers can replace legitimate files with malicious content, creating significant risk of malware propagation and data corruption. - **Remote Code Execution**: If the storage backend is shared with the extensions location, attackers can deploy malicious extensions that execute arbitrary code when loaded. - **Data Integrity Compromise**: Files can be tampered with or replaced without visible indication in the application interface.</p> <p>## Mitigation</p> <p>The `filename_disk` parameter should be treated as a server-controlled value. Uniqueness of storage paths must be enforced server-side, and `filename_disk` should be excluded from the fields users are permitted to update directly.</p> https://cve.radiocsirt.org/vuln/ghsa-393c-p46r-7c95