CVE-2025-55746criticalCWE-434CWE-73

CVE-2025-55746: critical vulnerability in directus

Directus allows unauthenticated file upload and file modification due to lacking input sanitization

Published

Follow this CVE+ Monitor directus+ Monitor directus

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.3epss 1.4%
Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents (without changes being applied to the files' database-resident metadata) and / or upload new files, with arbitrary content and extensions, which won't show up in the Directus UI. This vulnerability is fixed in 11.9.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L
Affected products
directus · directus
Related CVEs — directus

In the same product, most dangerous first.

CVE-2022-24814HIGHCross-site Scripting in DirectusEPSS 1.0%CVE-2025-53887MEDIUMDirectus's exact version number is exposed by the OpenAPI SpecEPSS 1.0%CVE-2022-36031MEDIUMUnhandled exception on illegal filename_disk valueEPSS 1.0%CVE-2023-26492MEDIUMDirectus vulnerable to Server-Side Request Forgery On File ImportEPSS 1.0%CVE-2023-45820MEDIUMDirectus crashes on invalid WebSocket messageEPSS 0.8%CVE-2022-23080—directus - SSRF which leads to internal port scanEPSS 0.8%