CVE-2019-13979 - In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads/_/originals remote code execution

HIGH

In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads/_/originals remote code execution

Published Jul 19, 2019

8.8

HIGH

CVSS 3.0

EPSS 2.58%

In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads/_/originals remote code execution.

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-5241		Advisory
https://github.com/directus/api/issues/979		x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://github.com/directus/api/projects/42		x_refsource_MISCThird Party Advisory