CVE-2019-13981

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads/_/originals/ directory. This is related to a configuration option in which the file collection can be non-public, but this option does not apply to the thumbnailer.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-425

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/directus/api/issues/986Exploit, Issue Tracking, Third Party Advisory
https://github.com/directus/api/issues/987Issue Tracking, Third Party Advisory
https://github.com/directus/api/issues/986Exploit, Issue Tracking, Third Party Advisory
https://github.com/directus/api/issues/987Issue Tracking, Third Party Advisory

Timeline

Published: Jul 19, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-139825.3interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text before rendering a preview.CVE-2019-139839.8Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php CVE-2019-139848.8Directus 7 API before 2.3.0 does not validate uploaded files. Regardless of the file extension or MIME type, there is a direct link to each CVE-2019-139886.5Sierra Wireless MGOS before 3.15.2 and 4.x before 4.3 allows attackers to read log files via a Direct Request (aka Forced Browsing).CVE-2019-139897.8dpic 2019.06.20 has a Stack-based Buffer Overflow in the wfloat() function in main.c.CVE-2019-13996.2A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on CVE-2019-139909.8initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job descript CVE-2019-139916.5Embedded systems based on Arduino before Rev3 allow remote attackers to send data to LEDs (directly connected to GPIO pins) via a laser, bec CVE-2019-139927.8u'Out of bound memory access if stack push and pop operation are performed without doing a bound check on stack top' in Snapdragon Auto, Sna CVE-2019-139947.8u'Lack of check that the current received data fragment size of a particular packet that are read from shared memory are less than the actua CVE-2019-139957.8u'Lack of integer overflow check for addition of fragment size and remaining size that are read from shared memory can lead to memory corrup CVE-2019-139987.8u'Lack of check that the TX FIFO write and read indices that are read from shared RAM are less than the FIFO size results into memory corrup