Loading story…
Directus fixed two high-severity vulnerabilities in versions prior to 11.17.0 that allowed authenticated, low-privilege users to bypass intended protections. One flaw, tracked as CVE-2026-35442, let users extract raw values from fields marked as concealed by abusing aggregate functions such as min and max, especially when combined with groupBy. The exposure could reveal sensitive data stored in affected collections, including static API tokens and two-factor authentication secrets from directus_users.
A second flaw, CVE-2026-39942, affected the file management API and allowed path traversal and broken access control through the PATCH /files/{id} endpoint. By supplying a user-controlled filename_disk value, an authenticated attacker could point writes at another user's storage path, overwrite file contents, and modify metadata such as uploaded_by to obscure the tampering. The issues were classified under weaknesses including CWE-200, CWE-863, CWE-284, and CWE-639, and both were remediated in Directus 11.17.0.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-04-09, GitHub published the security advisory and release reference for CVE-2026-39942. The vulnerability let a low-privileged authenticated attacker abuse the PATCH /files/{id} endpoint to overwrite another user's file by controlling the filename_disk parameter.
Directus released version 11.17.0 to fix CVE-2026-35442, which exposed concealed field values via aggregate queries, and CVE-2026-39942, which allowed path traversal and broken access control in the file management API. Both issues affected versions prior to 11.17.0.
A vulnerability later tracked as CVE-2026-35442 was received by GitHub's security advisories channel on 2026-04-06. The flaw allowed authenticated users to extract concealed field values through aggregate queries with groupBy in Directus versions before 11.17.0.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Directus disclosed **CVE-2026-61836**, a high-severity information disclosure flaw affecting versions prior to `12.0.0` when response caching is enabled. The vulnerability stems from cache keys that included the version, path, query, and `accountability.user` but failed to incorporate authorization context such as `share`, `role`, `roles`, `admin`, `app`, and `policies`. Because share-token requests and anonymous requests can both resolve to `user null`, different clients requesting the same URL could receive a cached response generated under another permission context, potentially exposing sensitive data without re-evaluating access controls. The issue is rated **CVSS 8.6** with vector `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N` and is mapped to **CWE-524** and **CWE-639**. A Directus code change addressed the problem by adding the share identifier from `req.accountability.share` to the cache key namespace, preventing collisions between different share tokens, anonymous requests, and authenticated sessions. The patch also introduced tests confirming that separate share tokens now generate distinct cache keys while repeated anonymous requests and repeated use of the same share token remain consistently cached.
Jul 15, 2026
Two high-severity vulnerabilities were disclosed affecting exposed application and device management surfaces, including a flaw that can give attackers **root access** and another that enables **arbitrary file write** through path traversal. **CVE-2026-3587** describes an unauthenticated remote attack path in a hidden CLI function that lets an attacker escape a restricted prompt and gain root access to the underlying Linux operating system, potentially leading to full device compromise. The issue was mapped to `CWE-912` and assigned a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with CERT VDE publishing advisory `VDE-2026-020`. A separate vulnerability, **CVE-2026-5027**, affects Langflow's `POST /api/v2/files` endpoint, where improper sanitization of the multipart `filename` parameter allows path traversal using `../` sequences. An authenticated attacker can exploit the bug to write files to arbitrary filesystem locations, creating a route to compromise confidentiality, integrity, and availability. The flaw was classified as `CWE-22`, carries the `CVSS v3.1` vector `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, and is referenced in Tenable advisory `TRA-2026-26`.
Jun 29, 2026
Dgraph disclosed two high-severity vulnerabilities that allowed unauthenticated attackers to compromise deployments through exposed administrative interfaces and query injection. **`CVE-2026-40173`** affects Dgraph **25.3.1 and earlier** and leaks the full process command line through the unauthenticated **`/debug/pprof/cmdline`** endpoint, exposing admin tokens passed with the startup flag **`--security "token=..."`**. Attackers can reuse the stolen token in the **`X-Dgraph-AuthToken`** header to reach admin-only endpoints such as **`/admin/config/cache_mb`**, enabling unauthorized configuration changes and other privileged operational actions when the Alpha HTTP port is reachable. A second flaw, **`CVE-2026-41327`**, affects versions **prior to 25.3.3** and allows pre-authentication full read access to databases running with the default configuration and **ACL disabled**. The bug is caused by unsafe concatenation of a crafted **`cond`** field in an upsert mutation sent to **`/mutate?commitNow=true`**, which enables **DQL injection** and returns server-side query results directly in the HTTP response. Dgraph addressed the issues in **25.3.2** and **25.3.3**, respectively, underscoring the risk to internet-exposed instances that had not restricted debug access or hardened authentication settings.
Jun 29, 2026