{"id":"CVE-2019-13981","details":"In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads/_/originals/ directory. This is related to a configuration option in which the file collection can be non-public, but this option does not apply to the thumbnailer.","modified":"2026-08-27T08:14:27.488200Z","published":"2019-07-19T15:15:12.313Z","references":[{"type":"REPORT","url":"https://github.com/directus/api/issues/986"},{"type":"REPORT","url":"https://github.com/directus/api/issues/987"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/directus/v8-archive","events":[{"introduced":"0"},{"last_affected":"ff05f586f4457c57ea3722bfb634b1d2b52b6c38"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:rangerstudio:directus_7_api:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"2.3.0"}]}}],"versions":["v2.3.0","v2.0.0-beta.1","2.0.0-alpha.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-13981.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}