CVE-2022-22117

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

In Directus, versions 9.0.0-alpha.4 through 9.4.1 allow unrestricted file upload of .html files in the media upload functionality, which leads to Cross-Site Scripting vulnerability. A low privileged attacker can upload a crafted HTML file as a profile avatar, and when an admin or another user opens it, the XSS payload gets triggered.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
directus	directus	>= 9.0.0, < unspecified; >= unspecified, <= 9.4.1

References

https://github.com/directus/directus/commit/ec86d5412d45136915d9b622b4a890dd26932b10Patch, Third Party Advisory
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22117Exploit, Third Party Advisory
https://github.com/directus/directus/commit/ec86d5412d45136915d9b622b4a890dd26932b10Patch, Third Party Advisory
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22117Exploit, Third Party Advisory

Timeline

Published: Jan 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-22128.8A vulnerability was found in SourceCodester Library Management System 1.0. It has been classified as critical. Affected is an unknown functi CVE-2022-221205.3In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset f CVE-2022-221218.0In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection). A low privileged attacker can cre CVE-2022-221235.4In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article title. An authenticated atta CVE-2022-221245.4In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the profile image. An authenticated atta CVE-2022-221254.8In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article tag. An authenticated admin CVE-2022-221266.1Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Web Page” element, that allows the injection of malicious JavaScr CVE-2022-221277.2Tableau is aware of a broken access control vulnerability present in Tableau Server affecting Tableau Server customers using Local Identity CVE-2022-221289.8Tableau discovered a path traversal vulnerability affecting Tableau Server Administration Agent’s internal file transfer service that could CVE-2022-22135.4A vulnerability was found in SourceCodester Library Management System 1.0. It has been declared as problematic. Affected by this vulnerabili CVE-2022-221376.5A memory corruption vulnerability exists in the ioca_mys_rgb_allocate functionality of Accusoft ImageGear 19.10. A specially-crafted malform CVE-2022-221387.5All versions of package fast-string-search are vulnerable to Denial of Service (DoS) when computations are incorrect for non-string inputs.