CVE-2025-55746

Published Aug 20, 2025

Last updated 3 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-55746 is a vulnerability affecting Directus, a real-time API and App dashboard for managing SQL database content. Specifically, versions 10.8.0 to before 11.9.3 are affected. The vulnerability lies in the file update mechanism, which allows unauthenticated attackers to modify existing files or upload new files with arbitrary content and extensions. These new files won't appear in the Directus UI. The issue has been patched in version 11.9.3. Attackers can exploit this vulnerability to modify existing files without updating their metadata or upload new files with arbitrary content and extensions. In certain configurations, such as those where servers serve files directly from the upload directory, attackers could upload a webshell, potentially leading to remote code execution. Attackers could also tamper with hosted documents by inserting malicious links to harvest credentials.

Description: Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents (without changes being applied to the files' database-resident metadata) and / or upload new files, with arbitrary content and extensions, which won't show up in the Directus UI. This vulnerability is fixed in 11.9.3.
Source: security-advisories@github.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.3
Impact score: 4.7
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L
Severity: CRITICAL

Weaknesses

security-advisories@github.com: CWE-73

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 13

References