VulnSocial

CVE-2026-39942Disclosure(monospace / directus)

LOWCVSS 8.8 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch monospace directus systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, the PATCH /files/{id} endpoint accepts a user-controlled filename_disk parameter. By setting this value to match the storage path of another user's file, an attacker can overwrite that file's content while manipulating metadata fields such as uploaded_by to obscure the tampering. This vulnerability is fixed in 11.17.0.

monospace CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-284CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • directus

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • 2 total mentions across 1 day

Affected systems

Vendors
monospace
Products
directus

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-04-09: 2Patch / Workaround · 2026-04-09: 2Technical Details · 2026-04-09: 204-09
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Full discourse2 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-39942 Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, the PATCH /files/{id} endpoint accepts a user-controlled filename_d… https://www.cve.org/CVERecord?id=CVE-2026-39942

    Post summary

    The post announces CVE-2026-39942 in Directus, detailing a user‑controlled filename flaw in the PATCH /files/{id} endpoint before version 11.17.0, and notes that the vulnerability has been patched in newer releases.

    00000102
    57.0K followersView on X
  • CVEFind.com@CveFindCom
    Patch

    [CVE-2026-39942: HIGH] Beware! Prior to version 11.17.0, Directus API vulnerability allowed attackers to overwrite files. Update now to secure your app from cyber threats.#cve,CVE-2026-39942,#cybersecurity https://cvefind.com/CVE-2026-39942

    Post summary

    The tweet highlights a high‑severity Directus API flaw that allows file overwrite and urges users to update to version 11.17.0 or later for protection.

    0000054
    619 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appmonospacedirectus-node.js-

Explore more

Back to dashboardmonospace CVEsdirectus vulnerabilities