Directus vulnerable to unhandled exception on illegal filename_disk value
The Directus process can be aborted by having an authorized user update the filename_disk value to a folder and accessing that file through the /assets endpoint.
The vulnerability is patched and released in v9.15.0.
You can prevent this problem by making sure no (untrusted) non-admin users have permissions to update the filename_disk field on directus_files.
For more information
If you have any questions or comments about this advisory:
- Open a Discussion in directus/directus
- Email us at security@directus.io
Credits
This vulnerability was first discovered and reported by Witold Gorecki.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | directus | < 9.15.0 | 9.15.0 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H- Weakness (CWE)
CWE-755- Platform
- npm
- Package
directus- Disclosed
- 30.08.2022
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-77qm-wvqq-fg79 - CC BY 4.0
Vulnerability history: directus
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 58
- First → latest
- 04.2022 07.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 19
- Medium 34
- Low 3
Disclosures per year
- 2022: 4
- 2023: 8
- 2024: 14
- 2025: 17
- 2026: 15
-
Directus vulnerable to unhandled exception on illegal filename_disk value this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.