CVE-2022-36031 - CVE House
Back to Database
Status published Medium CVE-2022-36031

Unhandled exception on illegal filename_disk value

Vulnerability Description

Directus is a free and open-source data platform for headless content management. The Directus process can be aborted by having an authorized user update the `filename_disk` value to a folder and accessing that file through the `/assets` endpoint. This vulnerability has been patched and release v9.15.0 contains the fix. Users are advised to upgrade. Users unable to upgrade may prevent this problem by making sure no (untrusted) non-admin users have permissions to update the `filename_disk` field on `directus_files`.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-36031

Credits & Attribution

No credits recorded in the NVD database.

References

More from directus

View All →
CVE-2025-64749
Directus Vulnerable to Information Leakage in Existing Collections
Medium 4.3
CVE-2025-64748
Directus's conceal fields are searchable if read permissions enabled
Medium 6.5
CVE-2025-64747
Directus Vulnerable to Stored Cross-site Scripting
Medium 5.5
CVE-2025-64746
Directus has Improper Permission Handling on Deleted Fields
Medium 4.6
CVE-2025-55746
Directus allows unauthenticated file upload and file modification due to lacking input sanitization
Critical 9.3

Affected Vendor

Affected Software

directus
Vulnerable Versions:
< 9.15.0

Timeline

Official Publish: August 19th, 2022
Last Modified: April 22nd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-755

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1203 Exploitation for Client Execution
Execution
T1213 Data from Information Repositories
Collection
T1499 Endpoint Denial of Service
Impact