Vulnerabilities

TI-2026-44255 CVE-2026-61836 · GHSA-c6w9-5g5j-jh2p

Directus: Authorization-dependent response served from unsegmented cache key

MEDIUM 44

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00474 Published 2026-07-15 Fixed in 12.0.0 CWE-524

TI-2026-44254 CVE-2026-61835 · GHSA-j5h6-vqc3-phqh

Directus: SSRF Protection Bypass via 0.0.0.0 in File Import

LOW 34

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00407 Published 2026-07-15 Fixed in 12.0.0 CWE-918

TI-2026-28806 CVE-2026-39943 · GHSA-mvv8-v4jj-g47j

Directus exposes sensitive fields in revision history

LOW 28

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00173 Published 2026-04-09 Fixed in 11.17.0 CWE-200

TI-2026-28805 CVE-2026-39942 · GHSA-393c-p46r-7c95

Directus has a Path Traversal and Broken Access Control in File Management API

LOW 37

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00208 Published 2026-04-09 Fixed in 11.17.0 CWE-284

TI-2026-27573 CVE-2026-35442 · GHSA-38hg-ww64-rrwc

Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries

LOW 37

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00343 Published 2026-04-06 Fixed in 11.17.0 CWE-200

TI-2026-27572 CVE-2026-35441 · GHSA-ph52-67fq-75wj

Directus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limits

LOW 29

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00368 Published 2026-04-06 Fixed in 11.17.0 CWE-400

TI-2026-27549 CVE-2026-35413 · GHSA-wxwm-3fxv-mrvx

Directus GraphQL Schema SDL Disclosure Setting

LOW 30

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00319 Published 2026-04-06 Fixed in 11.16.1 CWE-200

TI-2026-27548 CVE-2026-35412 · GHSA-qqmv-5p3g-px89

Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwrite

LOW 35

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00308 Published 2026-04-06 Fixed in 11.16.1 CWE-863

TI-2026-27547 CVE-2026-35411 · GHSA-q75c-4gmv-mg9x

Directus is an Open Redirect in Admin 2FA Setup Page

LOW 20

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00261 Published 2026-04-06 Fixed in 11.16.1 CWE-601

TI-2026-27546 CVE-2026-35410 · GHSA-cf45-hxwj-4cfj

Directus has an Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow

LOW 27

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00261 Published 2026-04-06 Fixed in 11.16.1 CWE-184

TI-2026-27545 CVE-2026-35409 · GHSA-wv3h-5fx7-966h

Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import

LOW 34

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00342 Published 2026-04-06 Fixed in 11.16.0 CWE-918

TI-2026-27544 CVE-2026-35408 · GHSA-8m32-p958-jg99

Directus is Missing Cross-Origin Opener Policy

MEDIUM 41

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00172 Published 2026-04-06 Fixed in 11.17.0 CWE-346

TI-2026-21176 CVE-2026-26185 · GHSA-jr94-gj3h-c8rf

Directus Affected by User Enumeration via Password Reset Timing Attack

LOW 30

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00393 Published 2026-02-12 Fixed in 11.14.1, 32.2.0 CWE-203

TI-2026-17726 CVE-2026-22032 · GHSA-3573-4c68-g8cc

Directus has open redirect in SAML

LOW 27

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00231 Published 2026-01-08 Fixed in 11.14.0, 32.1.1 CWE-601

TI-2025-40087 CVE-2025-64749 · GHSA-cph6-524f-3hgr

Directus Vulnerable to Information Leakage in Existing Collections

LOW 20

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00349 Published 2025-11-13 Fixed in 11.13.0, 32.0.0 CWE-203

TI-2025-40086 CVE-2025-64748 · GHSA-8jpw-gpr4-8cmh

Directus's conceal fields are searchable if read permissions enabled

LOW 29

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00296 Published 2025-11-13 Fixed in 11.13.0, 32.0.0 CWE-201

TI-2025-40085 CVE-2025-64747 · GHSA-vv2v-pw69-8crf

Directus Vulnerable to Stored Cross-site Scripting

LOW 24

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 5.5 Network Low privileges User interaction EPSS 0.00264 Published 2025-11-13 Fixed in 11.13.0 CWE-20

TI-2025-40084 CVE-2025-64746 · GHSA-9x5g-62gj-wqf2

Directus has Improper Permission Handling on Deleted Fields

MEDIUM 58

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00205 Published 2025-11-13 Fixed in 11.13.0 CWE-284

TI-2025-35166 CVE-2025-55746 · GHSA-mv33-9f6j-pfmc

Directus allows unauthenticated file upload and file modification due to lacking input sanitization

MEDIUM 49

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.014 Published 2025-08-20 Fixed in 11.9.3, 28.0.2 CWE-434

TI-2025-33764 CVE-2025-53889 · GHSA-7cvf-pxgp-42fc

Directus missing permission checks for manual trigger Flows

LOW 35

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00455 Published 2025-07-14 Fixed in 11.9.0 CWE-287

TI-2025-33762 CVE-2025-53887 · GHSA-rmjh-cf9q-pv7q

Directus's exact version number is exposed by the OpenAPI Spec

LOW 32

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01019 Published 2025-07-14 Fixed in 11.9.0 CWE-200

TI-2025-33761 CVE-2025-53886 · GHSA-f24x-rm6g-3w5v

Directus doesn't redact tokens in Flow logs

LOW 21

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 4.5 Network High privileges User interaction EPSS 0.00459 Published 2025-07-14 Fixed in 11.9.0 CWE-200

TI-2025-33760 CVE-2025-53885 · GHSA-x3vm-88hf-gpxp

Directus doesn't redact sensitive user data when logging via event hooks

LOW 19

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 4.2 Local High privileges User interaction EPSS 0.00202 Published 2025-07-14 Fixed in 11.9.0 CWE-532

TI-2025-21659 CVE-2025-30353 · GHSA-fm3h-p9wm-h74h

Directus's webhook trigger flows can leak sensitive data

HIGH 76

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00526 Published 2025-03-26 Fixed in 11.5.0 CWE-200

TI-2025-21658 CVE-2025-30352 · GHSA-7wq3-jr35-275c

Directus `search` query parameter allows enumeration of non permitted fields

MEDIUM 63

Directus is a real-time API and App dashboard for managing SQL database content.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00376 Published 2025-03-26 Fixed in 11.5.0 CWE-200

Vulnerabilities

Filters