A critical authorization bypass in Directus allows authenticated users to overwrite system files and manipulate metadata, posing a significant risk to data integrity.

This vulnerability involves improper access control and authorization bypass via a user-controlled filename_disk parameter in the PATCH /files/{id} endpoint. An authenticated attacker can overwrite existing files within the system and manipulate metadata fields to hide their activity.

The ability to overwrite files and tamper with metadata directly undermines the integrity of the database content managed by Directus. With a CVSS score of 8.5, this high-severity flaw could lead to unauthorized data modification, loss of critical business information, and potential regulatory compliance failures regarding data accuracy.

Immediate Action: Update the Directus instance to version 11.17.0 or later immediately to incorporate the necessary authorization checks.

Proactive Monitoring: Monitor server logs for unusual patterns of PATCH requests to the /files/ endpoint, particularly those involving modifications to file metadata or unexpected file path references.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to inspect and filter API requests to the /files/ endpoint, specifically looking for attempts to modify the filename_disk parameter.

Public Exploit Available: Unknown.

Given the potential for unauthorized data manipulation and loss of integrity, administrators must prioritize upgrading to version 11.17.0. Verify that all Directus instances are patched to this version, as the vulnerability resides in a core API function that is likely exposed in standard deployments.