CVE-2026-39942: Directus Privilege Escalation Vulnerability

CVE-2026-39942 Overview

CVE-2026-39942 is an Improper Access Control vulnerability in Directus, a real-time API and App dashboard for managing SQL database content. Prior to version 11.17.0, the PATCH /files/{id} endpoint accepts a user-controlled filename_disk parameter. By setting this value to match the storage path of another user's file, an attacker can overwrite that file's content while manipulating metadata fields such as uploaded_by to obscure the tampering.

Critical Impact

Authenticated attackers can overwrite arbitrary files belonging to other users, potentially leading to data tampering, integrity violations, and obscured audit trails through metadata manipulation.

Affected Products

• Directus versions prior to 11.17.0

Discovery Timeline

• 2026-04-09 - CVE CVE-2026-39942 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-39942

Vulnerability Analysis

This vulnerability stems from improper access control (CWE-284) in the Directus file management API. The PATCH /files/{id} endpoint fails to properly validate whether the requesting user has authorization to modify the target file's filename_disk parameter. This allows an authenticated user to specify an arbitrary storage path, including paths that correspond to files owned by other users.

The attack exploits the disconnect between the file ID being patched and the actual file storage location. By crafting a malicious request that sets filename_disk to point to another user's file path, an attacker can overwrite the contents of that file. Furthermore, the attacker can manipulate metadata fields like uploaded_by to hide evidence of the tampering, making forensic analysis more difficult.

Root Cause

The root cause is insufficient authorization checks in the file update endpoint. The API allows users to modify the filename_disk field without verifying that the specified storage path belongs to the file record being updated or that the user has appropriate permissions to modify files at that location. This creates a path traversal-like attack where file ownership boundaries can be bypassed through parameter manipulation.

Attack Vector

The attack is network-based and requires low-privilege authentication to the Directus instance. An attacker with a valid user account can send a crafted PATCH request to the /files/{id} endpoint with a filename_disk value matching another user's file storage path. This attack requires no user interaction and can be automated to target multiple files.

The vulnerability allows cross-user file manipulation by exploiting the trust placed in user-supplied filename_disk values. The attacker only needs to know or guess the target file's storage path, which may follow predictable patterns based on the Directus configuration.

Detection Methods for CVE-2026-39942

Indicators of Compromise

• Unexpected modifications to files in the Directus storage directory with mismatched uploaded_by metadata
• Audit logs showing PATCH requests to /files/{id} endpoints with filename_disk parameters pointing to paths outside the user's ownership
• File content changes where the modification timestamp differs from the associated metadata record
• Multiple files sharing the same filename_disk value in the database

Detection Strategies

• Monitor API access logs for PATCH requests to /files/{id} endpoints that include filename_disk parameter modifications
• Implement file integrity monitoring on the Directus storage directory to detect unauthorized modifications
• Correlate file system changes with database metadata to identify tampering attempts
• Alert on requests where the filename_disk value in a PATCH request differs from the existing record

Monitoring Recommendations

• Enable verbose logging on the Directus API server to capture all file modification requests
• Implement a Web Application Firewall (WAF) rule to flag suspicious filename_disk parameters in API requests
• Set up periodic integrity checks comparing file hashes against known good baselines
• Monitor for unusual patterns in file metadata updates, particularly changes to ownership fields

How to Mitigate CVE-2026-39942

Immediate Actions Required

• Upgrade Directus to version 11.17.0 or later immediately
• Audit existing files for signs of unauthorized modification by comparing content hashes with backup data
• Review access logs for suspicious PATCH requests to the /files/{id} endpoint
• Consider temporarily restricting file modification permissions until the patch is applied

Patch Information

Directus has released version 11.17.0 which addresses this vulnerability. The fix implements proper authorization checks to ensure users cannot modify the filename_disk parameter to reference files they do not own. Administrators should upgrade to this version as soon as possible.

For detailed information about the fix, see the GitHub Release v11.17.0 and the GitHub Security Advisory GHSA-393c-p46r-7c95.

Workarounds

• Implement API gateway rules to block or log PATCH requests that include the filename_disk parameter
• Restrict file modification capabilities to trusted administrator accounts until patching is complete
• Use network segmentation to limit access to the Directus API from untrusted networks
• Enable additional authentication factors for accounts with file management permissions

# Example: Nginx configuration to block filename_disk parameter in requests
location /files/ {
    if ($request_body ~* "filename_disk") {
        return 403;
    }
    proxy_pass http://directus_backend;
}