CVE-2022-22117

    Dashboard / Vulnerabilities / CVE-2022-22117

    CVE-2022-22117

    Published: 10 Jan 2022Last Modified: 12 Aug 2026

    Summary: Directus - Stored Cross-Site Scripting (XSS) in Profile Avatar Image

    Details: In Directus, versions 9.0.0-alpha.4 through 9.4.1 allow unrestricted file upload of .html files in the media upload functionality, which leads to Cross-Site Scripting vulnerability. A low privileged attacker can upload a crafted HTML file as a profile avatar, and when an admin or another user opens it, the XSS payload gets triggered.

    References: https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22117, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/22xxx/CVE-2022-22117.json, https://nvd.nist.gov/vuln/detail/CVE-2022-22117, https://github.com/directus/directus/commit/ec86d5412d45136915d9b622b4a890dd26932b10

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- ba72d2cfd040f7f0db282ccac006f36df6f05058
    Fixed -None

    Affected versions

    9.0.0
    9.0.0-NA

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-22117 | CVE-DB