CVE-2021-29641: Rangerstudio Directus

High severity, CVSS 8.8. EPSS: 4.9% chance of exploitation in the next 30 days.

Directus 8 before 8.8.2 allows remote authenticated users to execute arbitrary code because file-upload permissions include the ability to upload a .php file to the main upload directory and/or upload a .php file and a .htaccess file to a subdirectory. Exploitation succeeds only for certain installations with the Apache HTTP Server and the local-storage driver (e.g., when the product was obtained from hub.docker.com).

Affected products

• Rangerstudio Directus: from 8.0.0, before 8.8.2 (fixed in 8.8.2)

Published 2021-04-07. Last modified 2026-06-17.