Directus - Unauthenticated File Modification

Directus versions from 10.8.0 before 11.9.3 allow unauthenticated attackers to modify the contents of an existing file when a valid file UUID is known. The PATCH /files/id endpoint processes multipart file uploads without proper authentication, allowing file content replacement despite returning ...

@bicou/directus-extension-imagga (>=1.6.3, <=1.6.6), @directus/api (>=15.0.0, <=28.0.2) +3 more potentially affected by CVE-2025-55746 via directus (>=10.8.3, <=11.9.2)

directus NPM version =10.8.3, =1.6.3, =15.0.0, =1.2.2, =1.0.0, =2.0.0 - directus-extension-blog-year-filter 1.0.0 Source cves: CVE-2025-55746 Source advisory: OSV:GHSA-MV33-9F6J-PFMC...

directus (>=11.9.0, <=11.9.2) potentially affected by CVE-2025-55746 via @directus/api (>=28.0.0, <=28.0.2)

@directus/api NPM version =28.0.0, =11.9.0, =11.9.2 Source cves: CVE-2025-55746 Source advisory: SNYK:JS-DIRECTUSAPI-12079023...