Directus - Unauthenticated File Modification
Directus versions from 10.8.0 before 11.9.3 allow unauthenticated attackers to modify the contents of an existing file when a valid file UUID is known. The PATCH /files/{id} endpoint processes multipart file uploads without proper authentication, allowing file content replacement despite returning a 403 status code. This template requires a known, controlled Directus file UUID provided via the file_id variable.
DirectusPoC 已收录
CVSS—