directus

Vulnerabilities (53)

• CVE-2026-39943MedApr 9, 2026
  affected < 11.17.0fixed 11.17.0

  Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus stores revision records (in directus_revisions) whenever items are created or updated. Due to the revision snapshot code not consistently calling the prepareDelta sanitizat

• CVE-2026-39942HigApr 9, 2026
  affected < 11.17.0fixed 11.17.0

  Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, the PATCH /files/{id} endpoint accepts a user-controlled filename_disk parameter. By setting this value to match the storage path of another user's file, an attacker can overwrite t

• CVE-2026-35442HigApr 6, 2026
  affected < 11.17.0fixed 11.17.0

  Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, aggregate functions (min, max) applied to fields with the conceal special type incorrectly return raw database values instead of the masked placeholder. When combined with groupBy,

• CVE-2026-35441MedApr 6, 2026
  affected < 11.17.0fixed 11.17.0

  Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus' GraphQL endpoints (/graphql and /graphql/system) did not deduplicate resolver invocations within a single request. An authenticated user could exploit GraphQL aliasing to

• CVE-2026-35413MedApr 6, 2026
  affected < 11.16.1fixed 11.16.1

  Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, when GRAPHQL_INTROSPECTION=false is configured, Directus correctly blocks standard GraphQL introspection queries (__schema, __type). However, the server_specs_graphql resolver on th

• CVE-2026-35412HigApr 6, 2026
  affected < 11.16.1fixed 11.16.1

  Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus' TUS resumable upload endpoint (/files/tus) allows any authenticated user with basic file upload permissions to overwrite arbitrary existing files by UUID. The TUS controll

• CVE-2026-35411MedApr 6, 2026
  affected < 11.16.1fixed 11.16.1

  Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus is vulnerable to an open redirect via the redirect query parameter on the /admin/tfa-setup page. When an administrator who has not yet configured Two-Factor Authentication

• CVE-2026-35410MedApr 6, 2026
  affected < 11.16.1fixed 11.16.1

  Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, an open redirect vulnerability exists in the login redirection logic. The isLoginRedirectAllowed function fails to correctly identify certain malformed URLs as external, allowing at

• CVE-2026-35409HigApr 6, 2026
  affected < 11.16.0fixed 11.16.0

  Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.0, a Server-Side Request Forgery (SSRF) protection bypass has been identified and fixed in Directus. The IP address validation mechanism used to block requests to local and private net

• CVE-2026-35408HigApr 6, 2026
  affected < 11.17.0fixed 11.17.0

  Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus's Single Sign-On (SSO) login pages lacked a Cross-Origin-Opener-Policy (COOP) HTTP response header. Without this header, a malicious cross-origin window that opens the Dire

• CVE-2026-26185Feb 12, 2026
  affected < 11.14.1fixed 11.14.1

  Directus is a real-time API and App dashboard for managing SQL database content. Before 11.14.1, a timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time differs by approximately 5

• CVE-2026-22032Jan 8, 2026
  affected < 11.14.0fixed 11.14.0

  Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.14.0, an open redirect vulnerability exists in the Directus SAML authentication callback endpoint. During SAML authentication, the `RelayState` parameter is intended to preserve t

• CVE-2025-64749Nov 13, 2025
  affected < 11.13.0fixed 11.13.0

  Directus is a real-time API and App dashboard for managing SQL database content. An observable difference in error messaging was found in the Directus REST API in versions of Directus prior to version 11.13.0. The `/items/{collection}` API returns different error messages for two

• CVE-2025-64748Nov 13, 2025
  affected < 11.13.0fixed 11.13.0

  Directus is a real-time API and App dashboard for managing SQL database content. A vulnerability in versions prior to 11.13.0 allows authenticated users to search concealed/sensitive fields when they have read permissions. While actual values remain masked (`****`), successful ma

• CVE-2025-64747Nov 13, 2025
  affected < 11.13.0fixed 11.13.0

  Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 11.13.0 that allows users with `upload files` and `edit item` permissions to inject malicious JavaScript through the Bloc

• CVE-2025-64746Nov 13, 2025
  affected < 11.13.0fixed 11.13.0

  Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.13.0, Directus does not properly clean up field-level permissions when a field is deleted. When a field is removed from a collection, its reference in the permissions table remain

• CVE-2025-55746Aug 20, 2025
  affected >= 10.8.0, < 11.9.3fixed 11.9.3

  Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents (without changes being applied

• CVE-2025-53889Jul 14, 2025
  affected < 11.9.0fixed 11.9.0

  Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.9.0, Directus Flows with a manual trigger are not validating whether the user triggering the Flow has permissions to the items provided as payload t

• CVE-2025-53887Jul 14, 2025
  affected < 11.9.0fixed 11.9.0

  Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, the exact Directus version number is incorrectly being used as OpenAPI Spec version this means that it is being exposed by the `/server/specs/oa

• CVE-2025-53886Jul 14, 2025
  affected < 11.9.0fixed 11.9.0

  Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flows with the WebHook trigger all incoming request details are logged including security sensitive data like access and ref