Vulnerabilities

Vulnerability · GHSA-95f8-mvw7-gpj9

File uploads can write into the extensions directory, leading to code execution in overlapping storage configurations

Published Oct 30, 2026 · catalog updated Oct 30, 2026 · File uploads can write

Last checked Nov 1, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for GHSA-95f8-mvw7-gpj9. A missing EPSS score is not a low risk. Compare File uploads can write with the linked advisory before you change production.

Severity

Medium6.6

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Version ranges on file

Affected products

npm directus

## Summary A user who is allowed to set and when creating files could upload into the directory Directus loads extensions from, whenever that directory was reachable through a configured storage location. Directus executes extension code inside the server process, so this leads to server-side code execution. With enabled, overwriting the entrypoint of an already loaded extension runs the uploaded code immediately. Otherwise it runs on the next restart or extension reload. ## Details The file upload path wrote to whichever storage location and the payload specified, as long as the path stayed inside the storage root. It did not check whether that path was also part of the extensions namespace. Two configurations expose this: - A local storage location whose root contains , for example with . An upload with overwrites that extension's entrypoint on disk. - pointing at a storage location that is also available for uploads. An upload into on that location places a new extension that is synced and loaded on the next start. An earlier guard added for this class compared the storage-root-prefixed path against the location-relative for local drivers, so it did not trigger for the second configuration when the extensions location used the local driver. The default configuration is not affected. and are not writable by non-admin roles unless an administrator grants them explicitly, the default local layout keeps and as sibling directories, and is unset by default. ## Impact An authenticated user whose role has create (or update) permission on with write access to the and fields can execute arbitrary JavaScript in the Directus process, on instances where an upload-writable storage location overlaps the extensions directory. That gives access to the process environment, any files and internal services the Directus process can reach, and full control over the application. ## Workarounds a. Do not grant non-admin roles write access to the and fields of . b. Keep outside every sto