CVE-2026-35412: 
JavaScript vulnerability analysis and mitigation

CVE-2026-35412 is an authorization bypass vulnerability in Directus' TUS resumable upload endpoint (/files/tus) that allows any authenticated user with basic file upload permissions to overwrite arbitrary existing files by UUID. It affects all Directus (npm) versions prior to 11.16.1 and was published on April 2, 2026, with the GitHub Advisory Database entry added April 4, 2026. The vulnerability carries a CVSS v3.1 base score of 7.1–8.1 (High), classified under CWE-863 (Incorrect Authorization) (GitHub Advisory, Directus Advisory).

The root cause is an incomplete authorization check (CWE-863) in the TUS controller: it verifies only that the authenticated user holds some permission on the directus_files collection (collection-level check), but never validates whether the user has item-level access to the specific file UUID being replaced. This contrasts with the standard REST upload path, which correctly enforces row-level permission rules such as "users can only update their own files." An attacker with valid credentials and basic upload permissions can craft a TUS PATCH request targeting any file's UUID to overwrite its stored bytes and update its database metadata record (GitHub Advisory, Directus Advisory).

Successful exploitation allows an authenticated low-privilege attacker to permanently overwrite any file in the directus_files collection, resulting in permanent data loss, metadata corruption (filename, type, and size are replaced with attacker-controlled values), and potential privilege escalation if admin-owned assets such as application templates or configuration files are targeted and replaced with malicious content. There is no confidentiality impact, but integrity and availability of stored files are severely affected (GitHub Advisory, Directus Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (2nd percentile), indicating a low near-term exploitation probability. Exploitation requires valid authentication credentials with at least basic file upload permissions, reducing the attack surface compared to unauthenticated vulnerabilities.

1. Reconnaissance: Identify a Directus instance running a version prior to 11.16.1 with TUS uploads enabled (default). Confirm the /files/tus endpoint is accessible.
2. Obtain credentials: Acquire valid Directus user credentials with at least basic file upload (directus_files create) permissions — these may be low-privilege accounts.
3. Identify target file UUID: Browse or query the directus_files collection (via the Directus API or admin panel) to obtain the UUID of the target file to overwrite (e.g., an admin-owned asset or application template).
4. Initiate TUS upload: Send a TUS POST request to /files/tus with appropriate TUS protocol headers (e.g., Upload-Length, Tus-Resumable: 1.0.0) and include the target file's UUID in the upload metadata to signal an overwrite operation.
5. Upload malicious content: Send one or more TUS PATCH requests to the upload URL with the attacker-controlled file content as the request body, replacing the original file's stored bytes.
6. Verify overwrite: Confirm via the Directus API or storage backend that the target file's content and metadata (filename, type, size) have been replaced with the attacker's payload (GitHub Advisory, Directus Advisory).

• Network: Unexpected TUS protocol requests (POST or PATCH) to /files/tus from user accounts that do not own the targeted file UUIDs; repeated TUS requests targeting file UUIDs belonging to administrative or high-privilege users.
• Logs: Directus access logs showing TUS endpoint activity (POST /files/tus, PATCH /files/tus/<upload-id>) from low-privilege user accounts against file UUIDs they do not own; mismatches between the authenticated user and the owner of the file UUID referenced in TUS metadata headers.
• File System / Storage: Unexpected changes to file content or size for files owned by admin or other users; file metadata records in directus_files showing updated filename_download, type, or filesize fields inconsistent with the owning user's activity.
• Database: Audit log entries (if enabled) showing directus_files record updates attributed to users who are not the file owner and did not perform the action via the standard REST API path.

Upgrade Directus to version 11.16.1 or later, which introduces item-level authorization checks in the TUS controller to enforce row-level permission rules (GitHub Advisory, Directus Advisory). If immediate patching is not feasible, disable TUS uploads entirely by setting the environment variable TUS_ENABLED=false — this removes the vulnerable endpoint while standard REST file uploads remain functional. Additionally, restrict file upload permissions to only trusted users and review access logs for suspicious TUS endpoint activity as a detection measure.

The vulnerability was discovered and responsibly disclosed by bugbunny.ai, with the advisory published by Directus maintainer br41nslug on April 2, 2026 (Directus Advisory). No significant broader media coverage or notable public researcher commentary beyond the official advisory has been identified at this time.