vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2022-22117

Directus - Stored Cross-Site Scripting (XSS) in Profile Avatar Image

MEDIUM
5.4
CVSS Score
Published: January 10, 2022 at 03:26 PM UTC
Updated: June 17, 2026 at 04:27 AM UTC
2 products affected across 2 vendorsDirectusDirectus

Using directus by directus?

Get instant alerts when new vulnerabilities affect directus - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM5.4
Exploit prediction
EPSS 0.6%

Description

In Directus, versions 9.0.0-alpha.4 through 9.4.1 allow unrestricted file upload of .html files in the media upload functionality, which leads to Cross-Site Scripting vulnerability. A low privileged attacker can upload a crafted HTML file as a profile avatar, and when an admin or another user opens it, the XSS payload gets triggered.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Directus· Rangerstudiocontainer
95%
9.0.1 ≤ v ≤ 9.4.19.0.09.0.0 alpha109.0.0 alpha119.0.0 alpha129.0.0 alpha139.0.0 alpha149.0.0 alpha159.0.0 alpha169.0.0 alpha179.0.0 alpha189.0.0 alpha199.0.0 alpha209.0.0 alpha219.0.0 alpha229.0.0 alpha239.0.0 alpha249.0.0 alpha259.0.0 alpha269.0.0 alpha279.0.0 alpha319.0.0 alpha329.0.0 alpha339.0.0 alpha349.0.0 alpha359.0.0 alpha369.0.0 alpha379.0.0 alpha389.0.0 alpha399.0.0 alpha49.0.0 alpha409.0.0 alpha419.0.0 alpha429.0.0 alpha59.0.0 alpha69.0.0 alpha79.0.0 alpha89.0.0 alpha99.0.0 beta09.0.0 beta19.0.0 beta109.0.0 beta119.0.0 beta129.0.0 beta139.0.0 beta149.0.0 beta29.0.0 beta39.0.0 beta49.0.0 beta59.0.0 beta79.0.0 beta89.0.0 beta99.0.0 rc09.0.0 rc19.0.0 rc109.0.0 rc1009.0.0 rc1019.0.0 rc119.0.0 rc129.0.0 rc139.0.0 rc149.0.0 rc159.0.0 rc179.0.0 rc189.0.0 rc199.0.0 rc29.0.0 rc209.0.0 rc219.0.0 rc229.0.0 rc239.0.0 rc249.0.0 rc259.0.0 rc269.0.0 rc279.0.0 rc289.0.0 rc299.0.0 rc39.0.0 rc309.0.0 rc319.0.0 rc329.0.0 rc339.0.0 rc349.0.0 rc359.0.0 rc369.0.0 rc379.0.0 rc389.0.0 rc399.0.0 rc49.0.0 rc409.0.0 rc419.0.0 rc429.0.0 rc439.0.0 rc449.0.0 rc459.0.0 rc469.0.0 rc479.0.0 rc489.0.0 rc499.0.0 rc59.0.0 rc509.0.0 rc519.0.0 rc529.0.0 rc539.0.0 rc549.0.0 rc559.0.0 rc569.0.0 rc579.0.0 rc589.0.0 rc599.0.0 rc69.0.0 rc609.0.0 rc619.0.0 rc629.0.0 rc639.0.0 rc649.0.0 rc659.0.0 rc669.0.0 rc679.0.0 rc689.0.0 rc699.0.0 rc79.0.0 rc709.0.0 rc719.0.0 rc729.0.0 rc739.0.0 rc749.0.0 rc759.0.0 rc769.0.0 rc779.0.0 rc789.0.0 rc799.0.0 rc89.0.0 rc809.0.0 rc819.0.0 rc829.0.0 rc839.0.0 rc849.0.0 rc859.0.0 rc869.0.0 rc879.0.0 rc889.0.0 rc899.0.0 rc99.0.0 rc909.0.0 rc919.0.0 rc929.0.0 rc939.0.0 rc949.0.0 rc959.0.0 rc969.0.0 rc979.0.0 rc989.0.0 rc99
Directus· Directus
60%
v ≥ 9.0.0v ≤ 9.4.19.0.0

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (2)

x_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://github.com/directus/directus/commit/ec86d5412d45136915d9b622b4a890dd26932b10
x_refsource_MISCExploitThird Party Advisory
Source: [email protected]
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22117

CVSS

5.4MEDIUMMend
Attack Vector
NETWORK
Complexity
LOW
Privileges
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card