CVE-2026-39942: 
JavaScript vulnerability analysis and mitigation

CVE-2026-39942 is a broken access control vulnerability in the Directus file management API that allows authenticated users to overwrite files belonging to other users by manipulating the filename_disk parameter. It affects all Directus (npm) versions prior to 11.17.0. The advisory was published on April 2, 2026, and the CVE was assigned on April 9, 2026. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) per NVD, or 8.5 (High) per the GitHub Security Advisory (GitHub Advisory, Feedly).

The root cause is improper access control (CWE-284) combined with authorization bypass through a user-controlled key (CWE-639). The PATCH /files/{id} endpoint in Directus accepts a user-supplied filename_disk parameter without server-side validation or uniqueness enforcement, allowing an attacker to set this value to the storage path of another user's file. Once the path is matched, the attacker's upload overwrites the target file's content. Additionally, the attacker can manipulate metadata fields such as uploaded_by to obscure evidence of tampering, complicating forensic analysis. In deployments where the storage backend is shared with the extensions directory, this flaw could escalate to remote code execution by deploying a malicious extension (GitHub Advisory).

An authenticated attacker with low privileges can overwrite arbitrary files owned by other users, enabling data destruction, data corruption, and integrity compromise without visible indication in the application interface. If the storage backend is co-located with the Directus extensions directory, an attacker could deploy a malicious extension and achieve remote code execution on the server. The ability to falsify the uploaded_by metadata field further hampers detection and incident response (GitHub Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability requires only a low-privileged authenticated account and no user interaction, making it relatively easy to exploit once access is obtained. The EPSS score is approximately 0.025% (0.000250), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Obtain authenticated access: Register or compromise a low-privileged user account on the target Directus instance (versions < 11.17.0).
2. Identify target file path: Browse or enumerate the filename_disk values of files belonging to other users via the Directus API (e.g., GET /files with appropriate filters), noting the storage path of the target file.
3. Craft malicious PATCH request: Send a PATCH /files/{id} request using the attacker's own file ID, setting the filename_disk parameter to the storage path of the victim's file:

   PATCH /files/{attacker_file_id}
   Authorization: Bearer <attacker_token>
   Content-Type: application/json
   
   {
     "filename_disk": "<victim_file_storage_path>",
     "uploaded_by": "<victim_user_id>"
   }

4. Overwrite target file: Upload malicious content (e.g., a web shell or corrupted data) to the attacker's file entry; the server writes it to the victim's storage path, overwriting the original content.
5. Obscure tampering: Set uploaded_by to the victim's user ID to mask the attacker's identity in metadata logs.
6. Escalate (if applicable): If the storage backend overlaps with the Directus extensions directory, upload a malicious extension file to achieve remote code execution when the extension is loaded by the server (GitHub Advisory).

• Network: Unusual PATCH /files/{id} API requests from low-privileged accounts containing filename_disk values that reference paths not associated with the requesting user; repeated API calls to enumerate file metadata (GET /files) from a single account.
• Logs: Directus API access logs showing PATCH /files/ requests with filename_disk parameters pointing to other users' storage paths; uploaded_by field updates that do not match the authenticated user making the request.
• File System: Unexpected modification timestamps on files in the Directus storage directory that do not correspond to legitimate user activity; new or modified files in the extensions directory that were not deployed through normal administrative channels.
• Application: Files whose content has changed but whose metadata (e.g., uploaded_by) attributes to a different user than expected; discrepancies between file revision history and actual file content (GitHub Advisory).

Upgrade Directus to version 11.17.0 or later, which fixes this vulnerability by treating filename_disk as a server-controlled value and enforcing server-side uniqueness of storage paths (GitHub Advisory, Directus Release). As an interim measure prior to patching, apply the principle of least privilege to minimize the number of authenticated users with access to the PATCH /files endpoint. Additionally, consider isolating the file storage backend from the extensions directory to prevent potential escalation to remote code execution. Review file access logs and audit trails for evidence of unauthorized filename_disk manipulation prior to patching.

The vulnerability was reported by security researchers r3dpower, pmins99, and odgrso, and the advisory was published by the Directus maintainer br41nslug on April 2, 2026 (GitHub Advisory). Brief community mentions appeared on Bluesky and Mastodon shortly after disclosure, with no significant controversy or extended public debate noted. Coverage has been limited to automated CVE tracking feeds and aggregators.