What is the CVSS score of CVE-2026-39942?

CVE-2026-39942 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Directus are affected by CVE-2026-39942?

Directus versions below 11.17.0 contain an authenticated file overwrite vulnerability (CVSS 8.5) that allows low-privileged users to corrupt arbitrary files and manipulate metadata, creating risk of…. A patch is available.

How to fix or mitigate CVE-2026-39942?

Within 24 hours: Identify all Directus deployments and confirm version numbers below 11.17.0; restrict access to /files/{id} PATCH endpoints to administrative users only via authentication controls. Within 7 days: Audit file modification logs for suspicious filename_disk parameter manipulation and metadata changes (uploaded_by field alterations); quarantine any evidence of tampering. Within 30 days: Upgrade all Directus instances to version 11.17.0 or later; restore files from verified backups created before exploitation window if tampering confirmed.

Directus CVE-2026-39942

EUVD-2026-20950 HIGH

Improper Access Control (CWE-284)

2026-04-09 GitHub_M

GHSA-393c-p46r-7c95

Authentication Bypass Directus

8.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 09, 2026 - 20:30 nvd

Patch available

EUVD ID Assigned

Apr 09, 2026 - 16:30 euvd

EUVD-2026-20950

Analysis Generated

Apr 09, 2026 - 16:30 vuln.today

CVE Published

Apr 09, 2026 - 16:07 nvd

HIGH 8.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on directus (1 direct, 2 indirect)

Ecosystem-wide dependent count for version 11.17.0.

DescriptionGitHub Advisory

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, the PATCH /files/{id} endpoint accepts a user-controlled filename_disk parameter. By setting this value to match the storage path of another user's file, an attacker can overwrite that file's content while manipulating metadata fields such as uploaded_by to obscure the tampering. This vulnerability is fixed in 11.17.0.

AnalysisAI

Authenticated file overwrite vulnerability in Directus < 11.17.0 allows low-privileged users to corrupt arbitrary files by manipulating the filename_disk parameter in PATCH /files/{id} requests. Attackers can overwrite other users' file content and forge metadata fields (e.g., uploaded_by) to hide evidence of tampering. Requires authenticated access (PR:L). Scope change (S:C) indicates potential cross-tenant impact. No public exploit identified at time of analysis.

Technical ContextAI

Root cause is improper access control (CWE-284) in file update endpoint. The filename_disk parameter lacks path validation, permitting traversal to storage locations outside the authenticated user's scope. Metadata manipulation capabilities compound the integrity impact by enabling attribution forgery. Affects Directus API before v11.17.0 (cpe:2.3:a:directus:directus).

RemediationAI

Vendor-released patch: upgrade to Directus 11.17.0 or later immediately. This version implements input validation on filename_disk to prevent path manipulation and enforces ownership checks before file operations. For systems unable to upgrade immediately, restrict access to the /files API endpoints via reverse proxy rules or disable file management functionality until patching is complete. Official security advisory with technical details: https://github.com/directus/directus/security/advisories/GHSA-393c-p46r-7c95. Release notes and upgrade instructions: https://github.com/directus/directus/releases/tag/v11.17.0. Verify file storage integrity post-patch if unauthorized access is suspected.