directus

Records62All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high17CVSS 7.0–8.9

Exploited now

directus records in CISA KEV

No directus vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Directus 56 records HIGH

Records

62 records

TI-2025-21659 CVE-2025-30353 · GHSA-fm3h-p9wm-h74h

Directus's webhook trigger flows can leak sensitive data

HIGH 76

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00526 Published 2025-03-26 Fixed in 11.5.0 CWE-200

TI-2024-36266 CVE-2024-54151 · GHSA-849r-qrwj-8rv4

Directus allows unauthenticated access to WebSocket events and operations

HIGH 72

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00695 Published 2024-12-09 Fixed in 11.3.0, 23.2.0 CWE-200

TI-2024-26791 CVE-2024-39896 · GHSA-jgf4-vwc3-r46v

Directus allows SSO User Enumeration

HIGH 72

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00506 Published 2024-07-08 Fixed in 10.13.0 CWE-200

TI-2024-23956 CVE-2024-36128 · GHSA-632p-p495-25m5

Directus is soft-locked by providing a string value to random string util

HIGH 72

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0062 Published 2024-06-03 Fixed in 10.11.2 CWE-754

TI-2024-26624 CVE-2024-39701 · GHSA-hxgm-ghmv-xjjm

Directus Incorrectly handles _in` filter

HIGH 67

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00423 Published 2024-07-08 Fixed in 10.6.0 CWE-284

TI-2025-21658 CVE-2025-30352 · GHSA-7wq3-jr35-275c

Directus `search` query parameter allows enumeration of non permitted fields

MEDIUM 63

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00376 Published 2025-03-26 Fixed in 11.5.0 CWE-200

TI-2024-26790 CVE-2024-39895 · GHSA-7hmh-pfrp-vcx4

Directus GraphQL Field Duplication Denial of Service (DoS)

MEDIUM 62

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00795 Published 2024-07-08 Fixed in 10.12.0, 1.1.6 CWE-400

TI-2023-24580 CVE-2023-45820 · GHSA-hmgw-9jrg-hf2m

Directus crashes on invalid WebSocket message

MEDIUM 62

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00834 Published 2023-10-19 Fixed in 10.6.2 CWE-755

TI-2022-16456 CVE-2022-36031 · GHSA-77qm-wvqq-fg79

Unhandled exception on illegal filename_disk value

MEDIUM 62

Directus is a free and open-source data platform for headless content management.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01 Published 2022-08-19 Fixed in 9.15.0 CWE-755

TI-2020-13714 CVE-2020-19850 · GHSA-3gvp-54v2-2jrp

An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of…

MEDIUM 62

An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01079 Published 2023-04-04 Fixed in 2.2.1 CWE-400

TI-2025-40084 CVE-2025-64746 · GHSA-9x5g-62gj-wqf2

Directus has Improper Permission Handling on Deleted Fields

MEDIUM 58

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00205 Published 2025-11-13 Fixed in 11.13.0 CWE-284

TI-2025-19959 CVE-2025-27089 · GHSA-99vm-5v2h-h6r6

Overlapping policies allow update to non-allowed fields in directus

MEDIUM 58

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00238 Published 2025-02-19 Fixed in 11.1.2, 23.1.0 CWE-863

TI-2024-18798 CVE-2024-28239 · GHSA-fr3w-2p22-6w7p

URL Redirection to Untrusted Site in OAuth2/OpenID in directus

MEDIUM 58

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00583 Published 2024-03-12 Fixed in 10.10.0 CWE-601

TI-2024-06058 CVE-2024-6533 · GHSA-9qrm-48qf-r2rw

Directus 10.13.0 - DOM-Based cross-site scripting (XSS) via layout_options

MEDIUM 58

Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the client.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00383 Published 2024-08-15 Fixed in 11.3.3 CWE-79

TI-2023-12987 CVE-2023-28443 · GHSA-8vg2-wf3q-mwv7

directus vulnerable to Insertion of Sensitive Information into Log File

MEDIUM 58

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00312 Published 2023-03-23 Fixed in 9.23.3 CWE-284

TI-2025-21656 CVE-2025-30350 · GHSA-rv78-qqrq-73m5

Directus's S3 assets become unavailable after a burst of HEAD requests

MEDIUM 57

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0044 Published 2025-03-26 Fixed in 11.5.0, 12.0.1 CWE-770

TI-2025-21561 CVE-2025-30225 · GHSA-j8xj-7jff-46mx

Directus's S3 assets become unavailable after a burst of malformed transformations

MEDIUM 57

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0044 Published 2025-03-26 Fixed in 11.5.0, 12.0.1 CWE-770

TI-2025-18096 CVE-2025-24353 · GHSA-pmf4-v838-29hg

Directus privilege escalation vulnerability using Share feature

MEDIUM 56

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00396 Published 2025-01-23 Fixed in 11.2.0, 13.3.1 CWE-269

TI-2024-26622 CVE-2024-39699 · GHSA-8p72-rcq4-h6pw

Directus has a Blind SSRF On File Import

MEDIUM 56

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00435 Published 2024-07-08 Fixed in 10.9.3, 17.1.0 CWE-918

TI-2025-21657 CVE-2025-30351 · GHSA-56p6-qw3c-fq2g

Suspended Directus user can continue to use session token to access API

MEDIUM 53

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00374 Published 2025-03-26 Fixed in 11.5.0, 24.0.1 +1 CWE-672

TI-2024-32089 CVE-2024-47822 · GHSA-vw58-ph65-6rxp

Directus inserts access token from query string into logs

MEDIUM 53

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 4.2 Local High privileges User interaction EPSS 0.00311 Published 2024-10-08 Fixed in 10.13.2, 21.0.0 CWE-532

TI-2024-06059 CVE-2024-6534 · GHSA-3fff-gqw3-vj86

Directus 10.13.0 - Insecure object reference via PATH presets

MEDIUM 53

Directus v10.13.0 allows an authenticated external attacker to modify presets created by the same user to assign them to another user.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00329 Published 2024-08-15 Fixed in 10.13.2 CWE-639

TI-2022-10193 CVE-2022-26969 · GHSA-g27j-74fp-xfpr

In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.

MEDIUM 51

In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00998 Published 2022-12-26 Fixed in 9.7.0 CWE-942

TI-2025-35166 CVE-2025-55746 · GHSA-mv33-9f6j-pfmc

Directus allows unauthenticated file upload and file modification due to lacking input sanitization

MEDIUM 49

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.014 Published 2025-08-20 Fixed in 11.9.3, 28.0.2 CWE-434

TI-2026-44255 CVE-2026-61836 · GHSA-c6w9-5g5j-jh2p

Directus: Authorization-dependent response served from unsegmented cache key

MEDIUM 44

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00474 Published 2026-07-15 Fixed in 12.0.0 CWE-524

Open these records in search →