Critical severity9.3NVD Advisory· Published Aug 20, 2025· Updated Jun 17, 2026
CVE-2025-55746
CVE-2025-55746
Description
Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents (without changes being applied to the files' database-resident metadata) and / or upload new files, with arbitrary content and extensions, which won't show up in the Directus UI. This vulnerability is fixed in 11.9.3.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
directusnpm | >= 10.8.0, < 11.9.3 | 11.9.3 |
@directus/apinpm | >= 14.1.0, < 28.0.2 | 28.0.2 |
Affected products
4- ghsa-coords2 versions
>= 14.1.0, < 28.0.2+ 1 more
- (no CPE)range: >= 14.1.0, < 28.0.2
- (no CPE)range: >= 10.8.0, < 11.9.3
Patches
Vulnerability mechanics
References
4- github.com/directus/directus/commit/d84dcc36f75fc5c858d43746b8f9c426c38d696bnvdPatchWEB
- github.com/directus/directus/security/advisories/GHSA-mv33-9f6j-pfmcnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-mv33-9f6j-pfmcghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-55746ghsaADVISORY
News mentions
0No linked articles in our index yet.