CVE-2022-36031mediumCWE-755

CVE-2022-36031: fallo de gravedad media en directus

Unhandled exception on illegal filename_disk value

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear directus+ Monitorear directus

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.5epss 1.0%
Directus is a free and open-source data platform for headless content management. The Directus process can be aborted by having an authorized user update the `filename_disk` value to a folder and accessing that file through the `/assets` endpoint. This vulnerability has been patched and release v9.15.0 contains the fix. Users are advised to upgrade. Users unable to upgrade may prevent this problem by making sure no (untrusted) non-admin users have permissions to update the `filename_disk` field on `directus_files`.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Productos afectados
directus · directus
CVEs relacionadas — directus

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-55746CRITICALDirectus allows unauthenticated file upload and file modification due to lacking input sanitizationEPSS 1.4%CVE-2022-24814HIGHCross-site Scripting in DirectusEPSS 1.0%CVE-2025-53887MEDIUMDirectus's exact version number is exposed by the OpenAPI SpecEPSS 1.0%CVE-2023-26492MEDIUMDirectus vulnerable to Server-Side Request Forgery On File ImportEPSS 1.0%CVE-2023-45820MEDIUMDirectus crashes on invalid WebSocket messageEPSS 0.8%CVE-2022-23080—directus - SSRF which leads to internal port scanEPSS 0.8%