Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.
CVE-2026-35412 is a low severity vulnerability with a CVSS score of 0.0. No known public exploits at this time.
Very low probability of exploitation
EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.
Directus' TUS resumable upload endpoint (/files/tus) allows any authenticated user with basic file upload permissions to overwrite arbitrary existing files by UUID. The TUS controller performs only collection-level authorization checks, verifying the user has some permission on directus_files, but never validates item-level access to the specific file being replaced. As a result, row-level permission rules (e.g., "users can only update their own files") are completely bypassed via the TUS path while being correctly enforced on the standard REST upload path.
directus_files by UUID, regardless of row-level permission rules.directus_files, a low-privilege user could replace them with malicious content.Disable TUS uploads by setting TUS_ENABLED=false if resumable uploads are not required.
This vulnerability was discovered and reported by bugbunny.ai.
Please cite this page when referencing data from Strobes VI. Proper attribution helps support our vulnerability intelligence research.