What’s Vulnerable › Products
directus vulnerabilities
57 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 33 published in the last 12 months.
Check whether your directus version is affected
Latest directus vulnerabilities
- CVE-2026-10716 — Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation (CVSS 7.5)
- CVE-2026-61836 — Directus: Authorization-dependent response served from unsegmented cache key (CVSS 8.6)
- CVE-2026-61835 — Directus: SSRF Protection Bypass via 0.0.0.0 in File Import (CVSS 7.7)
- CVE-2026-39943 — Directus exposes sensitive fields in revision history (CVSS 6.5)
- CVE-2026-39942 — Directus has a Path Traversal and Broken Access Control in File Management API (CVSS 8.8)
- CVE-2026-35442 — Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries (CVSS 8.1)
- CVE-2026-35441 — Directus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limits (CVSS 6.5)
- CVE-2026-35413 — Directus GraphQL Schema SDL Disclosure Setting (CVSS 5.3)
- CVE-2026-35412 — Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwrite (CVSS 8.1)
- CVE-2026-35411 — Directus is an Open Redirect in Admin 2FA Setup Page (CVSS 4.3)
- CVE-2026-35410 — Directus has an Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow (CVSS 6.1)
- CVE-2026-35409 — Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import (CVSS 7.7)
- CVE-2026-35408 — Directus is Missing Cross-Origin Opener Policy (CVSS 9.3)
- CVE-2026-26185 — Directus Affected by User Enumeration via Password Reset Timing Attack (CVSS 5.3)
- CVE-2026-22032 — Directus has open redirect in SAML (CVSS 6.1)
- CVE-2025-64749 — Directus Vulnerable to Information Leakage in Existing Collections (CVSS 4.3)
- CVE-2025-64748 — Directus's conceal fields are searchable if read permissions enabled (CVSS 6.5)
- CVE-2025-64747 — Directus Vulnerable to Stored Cross-site Scripting (CVSS 5.5)
- CVE-2025-64746 — Directus has Improper Permission Handling on Deleted Fields (CVSS 5.4)
- CVE-2025-55746 — Directus allows unauthenticated file upload and file modification due to lacking input sanitization (CVSS 7.5)
- CVE-2025-53889 — Directus missing permission checks for manual trigger Flows (CVSS 6.5)
- CVE-2025-53887 — Directus's exact version number is exposed by the OpenAPI Spec (CVSS 5.3)
- CVE-2025-53886 — Directus doesn't redact tokens in Flow logs (CVSS 4.5)
- CVE-2025-53885 — Directus doesn't redact sensitive user data when logging via event hooks (CVSS 4.2)
- CVE-2025-30353 — Directus's webhook trigger flows can leak sensitive data (CVSS 7.5)