Directus vulnerabilities

Products

• Directus 60

Newest

• directus Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation CVE-2026-10716 7.5 HighAugust 5, 2026
• directus Directus: Authorization-dependent response served from unsegmented cache key CVE-2026-61836 Fix available 8.6 HighJuly 15, 2026
• directus Directus: SSRF Protection Bypass via 0.0.0.0 in File Import CVE-2026-61835 Fix available 7.7 HighJuly 15, 2026
• directus Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries CVE-2026-35442 Fix available 8.1 HighApril 4, 2026
• directus Directus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limits CVE-2026-35441 Fix available 6.5 MediumApril 4, 2026
• directus Directus exposes sensitive fields in revision history CVE-2026-39943 Fix available 6.5 MediumApril 4, 2026
• directus Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwrite CVE-2026-35412 Fix available 7.1 HighApril 4, 2026
• directus Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import CVE-2026-35409 Fix available 7.7 HighApril 4, 2026
• directus Directus GraphQL Schema SDL Disclosure Setting CVE-2026-35413 Fix available 5.3 MediumApril 4, 2026
• directus Directus has an Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow CVE-2026-35410 Fix available 6.1 MediumApril 4, 2026
• directus Directus is an Open Redirect in Admin 2FA Setup Page CVE-2026-35411 Fix available 4.3 MediumApril 4, 2026
• directus Directus has a Path Traversal and Broken Access Control in File Management API CVE-2026-39942 Fix available 8.5 HighApril 4, 2026
• directus Directus is Missing Cross-Origin Opener Policy CVE-2026-35408 Fix available 8.7 HighApril 4, 2026
• directus, directus @directus/api +1 more Directus Affected by User Enumeration via Password Reset Timing Attack CVE-2026-26185 Fix available 5.3 MediumFebruary 12, 2026
• directus Directus has open redirect in SAML CVE-2026-22032 Fix available 4.3 MediumJanuary 6, 2026
• directus Directus Vulnerable to Information Leakage in Existing Collections CVE-2025-64749 Fix available 4.3 MediumNovember 13, 2025
• directus Directus Vulnerable to Stored Cross-site Scripting CVE-2025-64747 Fix available 5.5 MediumNovember 13, 2025
• directus Directus has Improper Permission Handling on Deleted Fields CVE-2025-64746 Fix available 4.6 MediumNovember 13, 2025
• directus Directus's conceal fields are searchable if read permissions enabled CVE-2025-64748 Fix available 6.5 MediumNovember 13, 2025
• directus Directus allows unauthenticated file upload and file modification due to lacking input sanitization CVE-2025-55746 Public exploitFix available 9.3 CriticalAugust 20, 2025
• directus Directus missing permission checks for manual trigger Flows CVE-2025-53889 Fix available 6.5 MediumJuly 14, 2025
• directus Directus's exact version number is exposed by the OpenAPI Spec CVE-2025-53887 Public exploitFix available 5.3 MediumJuly 14, 2025
• directus Directus doesn't redact tokens in Flow logs CVE-2025-53886 Fix available 4.5 MediumJuly 14, 2025
• directus Directus doesn't redact sensitive user data when logging via event hooks CVE-2025-53885 Fix available 4.2 MediumJuly 14, 2025
• directus Directus's webhook trigger flows can leak sensitive data CVE-2025-30353 Fix available 8.6 HighMarch 26, 2025
• directus Directus `search` query parameter allows enumeration of non permitted fields CVE-2025-30352 Fix available 5.3 MediumMarch 26, 2025
• directus Suspended Directus user can continue to use session token to access API CVE-2025-30351 Fix available 3.5 LowMarch 26, 2025
• directus Directus's S3 assets become unavailable after a burst of HEAD requests CVE-2025-30350 Fix available 5.3 MediumMarch 26, 2025
• directus Directus's S3 assets become unavailable after a burst of malformed transformations CVE-2025-30225 Fix available 5.3 MediumMarch 26, 2025
• directus Overlapping policies allow update to non-allowed fields in directus CVE-2025-27089 Fix available 5.4 MediumFebruary 19, 2025
• directus Directus privilege escalation vulnerability using Share feature CVE-2025-24353 Fix available 5.0 MediumJanuary 23, 2025
• directus Directus allows unauthenticated access to WebSocket events and operations CVE-2024-54151 Fix available 7.5 HighDecember 9, 2024
• directus Directus has an HTML Injection in Comment CVE-2024-54128 Fix available 5.7 MediumDecember 5, 2024
• directus Directus inserts access token from query string into logs CVE-2024-47822 Fix available 4.2 MediumOctober 8, 2024
• directus SSRF Loopback IP filter bypass in directus CVE-2024-46990 Fix available 5.0 MediumSeptember 18, 2024
• directus Directus's session is cached for OpenID and OAuth2 if `redirect` is not used CVE-2024-45596 Fix available 7.4 HighSeptember 10, 2024
• directus Directus 10.13.0 - Insecure object reference via PATH presets CVE-2024-6534 Fix available 4.3 MediumAugust 15, 2024
• directus Directus 10.13.0 - DOM-Based cross-site scripting (XSS) via layout_options CVE-2024-6533 Fix available 5.4 MediumAugust 15, 2024
• directus Directus allows SSO User Enumeration CVE-2024-39896 Fix available 7.5 HighJuly 8, 2024
• directus Directus GraphQL Field Duplication Denial of Service (DoS) CVE-2024-39895 Fix available 6.5 MediumJuly 8, 2024
• directus Directus Incorrectly handles _in` filter CVE-2024-39701 Fix available 6.3 MediumJuly 8, 2024
• directus Directus has a Blind SSRF On File Import CVE-2024-39699 Fix available 5.0 MediumJuly 8, 2024
• directus Directus is soft-locked by providing a string value to random string util CVE-2024-36128 Fix available 7.5 HighJune 3, 2024
• directus Directus Lacks Session Tokens Invalidation CVE-2024-34709 Fix available 5.4 MediumMay 13, 2024
• directus Directus allows redacted data extraction on the API through "alias" CVE-2024-34708 Fix available 4.9 MediumMay 13, 2024
• directus Session Token in URL in directus CVE-2024-28238 Fix available 2.3 LowMarch 12, 2024
• directus URL Redirection to Untrusted Site in OAuth2/OpenID in directus CVE-2024-28239 Fix available 5.4 MediumMarch 12, 2024
• directus Directus version number disclosure CVE-2024-27296 Fix available 5.3 MediumMarch 1, 2024
• directus Directus MySQL accent insensitive email matching CVE-2024-27295 Fix available 8.2 HighMarch 1, 2024
• directus Directus crashes on invalid WebSocket message CVE-2023-45820 Fix available 5.9 MediumOctober 19, 2023
• Show olderLoading…