Path traversal in Directus - #VU141282
Published: August 7, 2026
Vulnerability details
The vulnerability allows a remote user to overwrite arbitrary storage paths and existing stored file content.
The vulnerability exists due to path traversal in the TUS upload implementation when processing the filename_disk value supplied in the Upload-Metadata header. A remote user can send a specially crafted TUS upload request to overwrite arbitrary storage paths and existing stored file content.
Exploitation requires TUS uploads to be enabled and create permission on directus_files. On object storage drivers, relative traversal segments can escape the configured root prefix, and configuration-dependent server-side code execution may be possible if executed directories are placed inside the same storage location.