Description
Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents (without changes being applied to the files' database-resident metadata) and / or upload new files, with arbitrary content and extensions, which won't show up in the Directus UI. This vulnerability is fixed in 11.9.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| directus | directus | >= 10.8.0, < 11.9.3 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
r4bbit-r4/directus-preso ★ 1 · Sep 2, 2025
Presentation about CVE-2025-55746
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Directus - Unauthenticated File Modification http/cves/2025/CVE-2025-55746.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @directus/api | >= 14.1.0, < 28.0.2 | 28.0.2 | GHSA-mv33-9f6j-pfmc |
| npm | directus | >= 10.8.0, < 11.9.3 | 11.9.3 | GHSA-mv33-9f6j-pfmc |