Vulnerabilities

Vulnerability · GHSA-3742-46gx-c8cc

Improper path validation in TUS uploads allows writing to arbitrary storage paths

Published Aug 5, 2026 · catalog updated Aug 5, 2026 · Improper path validation in

Last checked Nov 1, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for GHSA-3742-46gx-c8cc. A missing EPSS score is not a low risk. Compare Improper path validation in with the linked advisory before you change production.

Severity

High7.1

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Version ranges on file

Affected products

npm directus

## Summary The TUS (resumable upload) implementation creates the record through the generic rather than through . The sanitisation and validation that applies on the regular upload path is therefore skipped, and the value supplied by the client in the TUS header is passed verbatim to the storage driver as the destination path. An authenticated user who is permitted to create files can consequently choose the storage path their upload is written to, place uploads outside the configured storage root prefix, and overwrite the stored content of existing file records. ## Impact The concrete effect depends on the storage driver in use: - **Local driver.** The supplied path is joined onto the storage root after leading traversal segments are dropped, so writes remain inside the storage root. The attacker still controls the complete sub path and can create or overwrite any object beneath it. - **Object storage drivers (S3 and equivalents).** The supplied path is joined onto the configured root prefix without normalisation, so relative traversal segments escape that prefix and can address any key in the bucket or container. In both cases no uniqueness check is performed on , so an upload can be pointed at the disk name of an existing file record. The bytes served for that unrelated record are then replaced with attacker controlled content. Where the deployment places the extensions directory or the temporary directory inside the storage root, or serves extensions from the same storage location used for uploads, this write primitive reaches a location whose contents are loaded and executed by the server. That escalation is configuration dependent and is not reachable in a default deployment. ## Preconditions - TUS uploads enabled ( , which defaults to ). - An authenticated account holding create permission on . No administrative access is required. ## Workarounds - Leave TUS uploads disabled ( , the default). - Restrict create permission on to trusted roles. - Keep the extens