CVE-2026-35412

Requires authenticated access to Directus with basic file upload permissions. Attacker exploits TUS resumable upload endpoint (/files/tus) to bypass row-level access controls, overwriting arbitrary files by UUID. Default Directus installations with any authenticated users are vulnerable.

Real-world risk is moderate-to-high for Directus deployments using TUS uploads with multi-tenant or role-based access models. The CVSS base score of 7.1 (High severity) reflects network accessibility (AV:N), low attack complexity (AC:L), and high integrity impact (I:H) with low availability impact (A:L). The requirement for low-privilege authentication (PR:L) reduces immediate exposure compared to unauthenticated flaws, but any user with basic file upload rights becomes a threat actor. No EPSS data is available to quantify exploitation probability, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation campaigns. However, the presence of a detailed GitHub Security Advisory with clear reproduction steps significantly lowers the barrier for weaponization. The attack is automatable once credentials are obtained, and the technical impact is severe-permanent data loss and potential privilege escalation if system-critical files are targeted. Organizations using Directus in SaaS or multi-user environments with TUS enabled face immediate risk, while single-admin installations see reduced exposure. The availability of a simple configuration workaround (TUS_ENABLED=false) provides immediate mitigation, making this a priority fix for production systems but not an emergency patch requiring out-of-band deployment.

An attacker with low-privilege authenticated access to a multi-tenant Directus instance identifies a high-value file UUID (such as a company logo, PDF template, or configuration file owned by an administrator) by enumerating the directus_files collection through allowed API queries. The attacker initiates a TUS resumable upload session to the /files/tus endpoint, specifying the victim file's UUID as the target. Because the TUS controller only checks collection-level permissions and the attacker has basic file upload rights, the request bypasses row-level ownership validation. The attacker uploads malicious content (e.g., a phishing page disguised as the company logo, or a backdoored PDF template), which permanently overwrites the original file in both storage and database metadata. When legitimate users or administrators retrieve the file, they unknowingly receive attacker-controlled content, enabling phishing attacks, data exfiltration, or further system compromise depending on how the replaced file is used within the application.