CVE-2021-29641

CVE-2021-29641 is a critical vulnerability affecting Directus 8 prior to version 8.8.2, allowing remote authenticated users to achieve arbitrary code execution. This is due to insufficient file upload restrictions, enabling the upload of malicious PHP files, potentially alongside .htaccess files, into the main upload directory or subdirectories. The vulnerability carries a high CVSS score of 8.8, indicating a network-based attack with low complexity and high impact on confidentiality, integrity, and availability. While exploitation is limited to specific Apache HTTP Server and local-storage driver configurations (e.g., Docker deployments), there is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.