External Control of File Name or Path in Directus - #VU158875
Published: November 3, 2026
Vulnerability details
The vulnerability allows a remote privileged user to execute arbitrary JavaScript in the Directus server process and gain full control over the application.
The vulnerability exists due to external control of file names and paths without checking the extensions namespace in the Directus file upload handler when an upload-writable storage location overlaps the extensions directory. A remote privileged user can create or update files with crafted storage and filename_disk values to place executable extension code in that directory or overwrite an existing extension entrypoint, causing arbitrary code execution when the extension is loaded.
With EXTENSIONS_AUTO_RELOAD enabled, overwriting an already loaded extension's entrypoint executes the uploaded code immediately; otherwise, execution occurs on the next restart or extension reload.