CVE-2026-39942: Directus: Path Traversal and Broken Access Control in File Management API

April 4, 2026 (updated April 9, 2026)

A broken access control vulnerability was identified in the Directus file management API that allows authenticated users to overwrite files belonging to other users by manipulating the filename_disk parameter.

References

github.com/advisories/GHSA-393c-p46r-7c95
github.com/directus/directus
github.com/directus/directus/security/advisories/GHSA-393c-p46r-7c95
nvd.nist.gov/vuln/detail/CVE-2026-39942

Code Behaviors & Features

Detect and mitigate CVE-2026-39942 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →