PT-2026-31648

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, the PATCH /files/id endpoint accepts a user-controlled filename disk parameter. By setting this value to match the storage path of another user's file, an attacker can overwrite that file's content...