CVE-2025-55746: Directus allows unauthenticated file upload and file modification due to lacking input sanitization

August 20, 2025

A vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents (without changes being applied to the files’ database-resident metadata) and / or upload new files, with arbitrary content and extensions, which won’t show up in the Directus UI.

References

github.com/advisories/GHSA-mv33-9f6j-pfmc
github.com/directus/directus
github.com/directus/directus/commit/d84dcc36f75fc5c858d43746b8f9c426c38d696b
github.com/directus/directus/security/advisories/GHSA-mv33-9f6j-pfmc
nvd.nist.gov/vuln/detail/CVE-2025-55746

Code Behaviors & Features

Detect and mitigate CVE-2025-55746 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →