GCVE - cpe:2.3:a:rangerstudio:directus_7_api:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:rangerstudio:directus_7_api:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Rangerstudio (`2935f6b4-46fe-5a45-aaeb-d8081cf444d4`)
Product	Directus 7 Api (`73ff5c0a-7456-5765-8b06-b2d6f260ca87`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/directus/v8-archive`	purl2cpe	2026-06-01 10:14:55.414444

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2019-13984`	vulnerable	2026-06-08 05:12:52.905976	Details available Directus 7 API before 2.3.0 does not validate uploaded files. Regardless of the file extension or MIME type, there is a direct link to each uploaded file, accessible by unauthenticated users, as demonstrated by the EICAR Anti-Virus Test File. Published: 2019-07-19T14:17:32.000Z Updated: 2024-08-05T00:05:44.146Z Open on db.gcve.eu Reference links https://github.com/directus/api/issues/981 https://github.com/directus/api/projects/44	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-13983`	vulnerable	2026-06-08 05:12:52.905450	Details available Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php and endpoints/Auth.php. Published: 2019-07-19T14:17:42.000Z Updated: 2024-08-05T00:05:44.139Z Open on db.gcve.eu Reference links https://github.com/directus/api/issues/991 https://github.com/directus/api/projects/43	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-13981`	vulnerable	2026-06-08 05:12:52.903293	Details available In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads/_/originals/ directory. This is related to a configuration option in which the file collection can be non-public, but this option does not apply to the thumbnailer. Published: 2019-07-19T14:17:58.000Z Updated: 2024-08-05T00:05:44.098Z Open on db.gcve.eu Reference links https://github.com/directus/api/issues/987 https://github.com/directus/api/issues/986	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-13980`	vulnerable	2026-06-08 05:12:52.902825	Details available In Directus 7 API through 2.3.0, uploading of PHP files is blocked only when the Apache HTTP Server is used, leading to uploads/_/originals remote code execution with nginx. Published: 2019-07-19T14:18:08.000Z Updated: 2024-08-05T00:05:44.164Z Open on db.gcve.eu Reference links https://github.com/directus/api/issues/979	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-13979`	vulnerable	2026-06-08 05:12:52.902261	Details available In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads/_/originals remote code execution. Published: 2019-07-19T14:18:16.000Z Updated: 2024-08-05T00:05:44.139Z Open on db.gcve.eu Reference links https://github.com/directus/api/issues/979 https://github.com/directus/api/projects/42	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.