CVE-2025-55746 Scanner
CVE-2025-55746 Scanner - Unauthenticated File Upload vulnerability in Directus
Used 3.4k times · 5.9k assets checked · domain, subdomain, ipv4
CVE
CVE-2025-55746
7.5
CVSScritical
Exploitable remotely over the internet · no authentication required.
Description
Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents (without changes being applied to the files' database-resident metadata) and / or upload new files, with arbitrary content and extensions, which won't show up in the Directus UI. This vulnerability is fixed in 11.9.3.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
directus
Updated Sep 18, 2026View on NVD →
S4E scanner
CVE history: directus
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →