CVE-2022-36031: Unhandled exception on illegal filename_disk value
Directus is a free and open-source data platform for headless content management. The Directus process can be aborted by having an authorized user update the filenamedisk value to a folder and accessing that file through the /assets endpoint. This vulnerability has been patched and release v9.15.0 contains the fix. Users are advised to upgrade. Users unable to upgrade may prevent this problem by making sure no (untrusted) non-admin users have permissions to update the filenamedisk field on directusfiles.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-36031?
CVE-2022-36031 is a vulnerability in Directus, an open-source data platform for headless content management, that allows an authorized user to abort the Directus process by manipulating the `filename_disk` value.
How can an attacker exploit CVE-2022-36031?
An attacker can exploit CVE-2022-36031 by updating the `filename_disk` value to a folder and accessing that file through the `/assets` endpoint, thereby aborting the Directus process.
What is the severity of CVE-2022-36031?
CVE-2022-36031 has a severity keyword of 'medium' and a severity value of 6.5.
Has CVE-2022-36031 been patched?
Yes, CVE-2022-36031 has been patched in the Directus release v9.15.0.
Where can I find more information about CVE-2022-36031?
More information about CVE-2022-36031 can be found in the GitHub security advisory: https://github.com/directus/directus/security/advisories/GHSA-77qm-wvqq-fg79