CVE-2026-39942

CVE-2026-39942 is a file overwrite vulnerability in Directus versions prior to 11.17.0 that affects the PATCH /files/{id} endpoint. An authenticated attacker can manipulate the user-controlled filename_disk parameter to overwrite other users' files while falsifying metadata fields like uploaded_by to conceal the tampering. This vulnerability was remediated in version 11.17.0. The vulnerability carries a CVSS score of 8.8 (HIGH) with a network-based attack vector requiring only low complexity and valid user credentials, but no additional user interaction. The attack scope is unchanged, with impacts spanning confidentiality, integrity, and availability. An authenticated attacker could read, modify, or delete arbitrary files within the Directus storage system. Exploitation status remains low risk at present. The vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and shows no evidence of active exploitation in the wild. No public exploit code or proof-of-concept has achieved significant community attention, as reflected by the negligible EPSS score of 0.00034. Organizations should prioritize patching to version 11.17.0 to mitigate this privilege escalation and data tampering risk.