CVE-2026-39942 - Vulnerability Analysis

Overview

Directus < 11.17.0 contains a file overwrite vulnerability caused by insufficient validation of the filename_disk parameter in PATCH /files/{id} endpoint, letting attackers overwrite other users' files and manipulate metadata, exploit requires crafted request with specific filename_disk value.

Severity & Score

Impact

Attackers can overwrite other users' files and manipulate metadata, leading to data tampering and potential information loss.

Mitigation

Update to version 11.17.0 or later.

References

• https://github.com/directus/directus/releases/tag/v11.17.0
• https://github.com/directus/directus/security/advisories/GHSA-393c-p46r-7c95

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 12, 2026

🟠 CVE-2026-39942 - High (8.5) Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, the PATCH /files/{id} endpoint accepts a user-controlled filename_disk parameter. By setting this value to match the storage path of another user's ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39942/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner