{"id":"CVE-2026-35412","aliases":["EUVD-2026-19520","GHSA-qqmv-5p3g-px89"],"status":"published","title":"Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwrite","description":"Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus' TUS resumable upload endpoint (/files/tus) allows any authenticated user with basic file upload permissions to overwrite arbitrary existing files by UUID. The TUS controller performs only collection-level authorization checks, verifying the user has some permission on directus_files, but never validates item-level access to the specific file being replaced. As a result, row-level permission rules (e.g., \"users can only update their own files\") are completely bypassed via the TUS path while being correctly enforced on the standard REST upload path. This vulnerability is fixed in 11.16.1.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00308,"percentile":0.23913,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-04-04T06:11:18Z","modified":"2026-10-28T02:30:36Z","fixes":[{"ecosystem":"npm","package":"directus","fixed_in":["11.16.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"directus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.16.1"}]}]},{"source":"osv","ecosystem":"npm","package":"directus","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"11.16.1"}]}]}],"products":[{"vendor":"directus","product":"directus"},{"vendor":"monospace","product":"directus"}],"references":[{"url":"https://github.com/directus/directus/security/advisories/GHSA-qqmv-5p3g-px89","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35412","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qqmv-5p3g-px89"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35412.json","tags":["advisory"]},{"url":"https://github.com/directus/directus","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-35412","title":"Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwrite","description":"Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus' TUS resumable upload endpoint (/files/tus) allows any authenticated user with basic file upload permissions to overwrite arbitrary existing files by UUID. The TUS controller performs only collection-level authorization checks, verifying the user has some permission on directus_files, but never validates item-level access to the specific file being replaced. As a result, row-level permission rules (e.g., \"users can only update their own files\") are completely bypassed via the TUS path while being correctly enforced on the standard REST upload path. This vulnerability is fixed in 11.16.1.","status":"published","published":"2026-04-06T21:33:44.867Z","modified":"2026-04-07T16:23:16.091Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:20:05.15083Z"}],"euvd":[{"id":"EUVD-2026-19520","description":"Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus' TUS resumable upload endpoint (/files/tus) allows any authenticated user with basic file upload permissions to overwrite arbitrary existing files by UUID. The TUS controller performs only collection-level authorization checks, verifying the user has some permission on directus_files, but never validates item-level access to the specific file being replaced. As a result, row-level permission rules (e.g., \"users can only update their own files\") are completely bypassed via the TUS path while being correctly enforced on the standard REST upload path. This vulnerability is fixed in 11.16.1.","status":"published","published":"2026-04-06T21:33:44Z","modified":"2026-04-07T16:23:16Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T19:25:12.431163Z"}],"ghsa":[{"id":"GHSA-qqmv-5p3g-px89","title":"Directus: TUS Upload Authorization Bypass Allows Arbitrary File Overwrite","description":"## Summary\n\nDirectus' TUS resumable upload endpoint (`/files/tus`) allows any authenticated user with basic file upload permissions to overwrite arbitrary existing files by UUID. The TUS controller performs only collection-level authorization checks, verifying the user has some permission on `directus_files`, but never validates item-level access to the specific file being replaced. As a result, row-level permission rules (e.g., \"users can only update their own files\") are completely bypassed via the TUS path while being correctly enforced on the standard REST upload path.\n\n## Impact\n\n- **Arbitrary file overwrite:** Any authenticated user with basic TUS upload permissions can overwrite any file in `directus_files` by UUID, regardless of row-level permission rules.\n- **Permanent data loss:** The victim file's original stored bytes are deleted from storage and replaced with attacker-controlled content.\n- **Metadata corruption:** The victim file's database record is updated with the attacker's filename, type, and size metadata.\nPrivilege escalation potential: If admin-owned files (e.g., application assets, templates) are stored in `directus_files`, a low-privilege user could replace them with malicious content.\n\n## Workaround\n\nDisable TUS uploads by setting `TUS_ENABLED=false` if resumable uploads are not required.\n\n## Credit\n\nThis vulnerability was discovered and reported by [bugbunny.ai](https://bugbunny.ai).","status":"published","published":"2026-04-04T06:11:18Z","modified":"2026-04-07T14:20:13Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:39:50.076383Z"}],"nvd":[{"id":"CVE-2026-35412","description":"Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus' TUS resumable upload endpoint (/files/tus) allows any authenticated user with basic file upload permissions to overwrite arbitrary existing files by UUID. The TUS controller performs only collection-level authorization checks, verifying the user has some permission on directus_files, but never validates item-level access to the specific file being replaced. As a result, row-level permission rules (e.g., \"users can only update their own files\") are completely bypassed via the TUS path while being correctly enforced on the standard REST upload path. This vulnerability is fixed in 11.16.1.","status":"published","published":"2026-04-06T22:16:22.397Z","modified":"2026-07-24T21:10:00.143Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:13.1424Z"}],"osv":[{"id":"CVE-2026-35412","title":"Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwrite","description":"Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus' TUS resumable upload endpoint (/files/tus) allows any authenticated user with basic file upload permissions to overwrite arbitrary existing files by UUID. The TUS controller performs only collection-level authorization checks, verifying the user has some permission on directus_files, but never validates item-level access to the specific file being replaced. As a result, row-level permission rules (e.g., \"users can only update their own files\") are completely bypassed via the TUS path while being correctly enforced on the standard REST upload path. This vulnerability is fixed in 11.16.1.","status":"published","published":"2026-04-06T21:33:44.867Z","modified":"2026-10-28T02:30:36.551016117Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:45:02.673625Z"},{"id":"GHSA-qqmv-5p3g-px89","title":"Directus: TUS Upload Authorization Bypass Allows Arbitrary File Overwrite","description":"## Summary\n\nDirectus' TUS resumable upload endpoint (`/files/tus`) allows any authenticated user with basic file upload permissions to overwrite arbitrary existing files by UUID. The TUS controller performs only collection-level authorization checks, verifying the user has some permission on `directus_files`, but never validates item-level access to the specific file being replaced. As a result, row-level permission rules (e.g., \"users can only update their own files\") are completely bypassed via the TUS path while being correctly enforced on the standard REST upload path.\n\n## Impact\n\n- **Arbitrary file overwrite:** Any authenticated user with basic TUS upload permissions can overwrite any file in `directus_files` by UUID, regardless of row-level permission rules.\n- **Permanent data loss:** The victim file's original stored bytes are deleted from storage and replaced with attacker-controlled content.\n- **Metadata corruption:** The victim file's database record is updated with the attacker's filename, type, and size metadata.\nPrivilege escalation potential: If admin-owned files (e.g., application assets, templates) are stored in `directus_files`, a low-privilege user could replace them with malicious content.\n\n## Workaround\n\nDisable TUS uploads by setting `TUS_ENABLED=false` if resumable uploads are not required.\n\n## Credit\n\nThis vulnerability was discovered and reported by [bugbunny.ai](https://bugbunny.ai).","status":"published","published":"2026-04-04T06:11:18Z","modified":"2026-04-07T14:35:33.556091Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:54.760124Z"}]}}