Directus up to 11.16.0 /files/tus authorization

Summaryinfo

A vulnerability was found in Directus up to 11.16.0 and classified as problematic. This vulnerability affects unknown code of the file /files/tus. Such manipulation leads to authorization. This vulnerability is listed as CVE-2026-35412. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Directus up to 11.16.0. It has been rated as problematic. Affected by this issue is an unknown code of the file /files/tus. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. Impacted is integrity, and availability. CVE summarizes:

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus' TUS resumable upload endpoint (/files/tus) allows any authenticated user with basic file upload permissions to overwrite arbitrary existing files by UUID. The TUS controller performs only collection-level authorization checks, verifying the user has some permission on directus_files, but never validates item-level access to the specific file being replaced. As a result, row-level permission rules (e.g., "users can only update their own files") are completely bypassed via the TUS path while being correctly enforced on the standard REST upload path. This vulnerability is fixed in 11.16.1.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-35412 since 04/02/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available.

Upgrading to version 11.16.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Directus

Version

• 11.0
• 11.1
• 11.2
• 11.3
• 11.4
• 11.5
• 11.6
• 11.7
• 11.8
• 11.9
• 11.10
• 11.11
• 11.12
• 11.13
• 11.14
• 11.15
• 11.16.0

Website

• Product: https://github.com/directus/directus/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion