SB2026110359 - Multiple vulnerabilities in Directus

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110359

SB2026110359 - Multiple vulnerabilities in Directus

Published: November 3, 2026

Security Bulletin ID SB2026110359
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Prototype pollution (CVE-ID: N/A)

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a persistent denial of service by polluting the shared object prototype, causing logins and most reads to fail with database errors.

The vulnerability exists due to improperly controlled modification of object prototype attributes in the Directus CSV importer's setDeep helper when processing nested CSV headers and JSON-parsed cell values. A remote user can import a CSV into a collection on which they have create and update permissions, using the headers a,a.__proto__.polluted with corresponding cell values {},"yes" to set Object.prototype.polluted to 'yes'. Subsequent object-form database queries enumerate this inherited property and reference a nonexistent column, causing a persistent denial of service.


2) External Control of File Name or Path (CVE-ID: N/A)

CWE-ID: CWE-73 - External Control of File Name or Path

CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to execute arbitrary JavaScript in the Directus server process and gain full control over the application.

The vulnerability exists due to external control of file names and paths without checking the extensions namespace in the Directus file upload handler when an upload-writable storage location overlaps the extensions directory. A remote privileged user can create or update files with crafted storage and filename_disk values to place executable extension code in that directory or overwrite an existing extension entrypoint, causing arbitrary code execution when the extension is loaded.

With EXTENSIONS_AUTO_RELOAD enabled, overwriting an already loaded extension's entrypoint executes the uploaded code immediately; otherwise, execution occurs on the next restart or extension reload.


Remediation

Install update from vendor's website.

References