Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

directus — Vulnerabilities & Security Advisories 60

All 60 CVE vulnerabilities found in directus, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerability data for Directus, an open-source headless Content Management System, focusing on security weaknesses and their impact on this specific product. It collects various types of security flaws reported against Directus, covering a historical time range that spans multiple years of advisory releases. Readers can use this hub to track the vendor's recent security advisories, understand the specific weakness classes that have affected Directus, and review the product's vulnerability history. This centralized view supports risk assessment, patch prioritization, and compliance auditing by providing a clear, searchable index of known defects. The collection helps security teams identify recurring patterns and assess the overall security posture of Directus over time, without requiring manual aggregation from disparate sources.

Vendor: directus

CVE ID Title CVSS Severity Published
CVE-2026-10716 Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation CWE-89 7.5 High 2026-08-05
CVE-2026-61836 Directus: Authorization-dependent response served from unsegmented cache key CWE-524 8.6 High 2026-07-15
CVE-2026-61835 Directus: SSRF Protection Bypass via 0.0.0.0 in File Import CWE-918 7.7 High 2026-07-15
CVE-2026-39943 Directus exposes sensitive fields in revision history CWE-200 6.5 Medium 2026-04-09
CVE-2026-39942 Directus has a Path Traversal and Broken Access Control in File Management API CWE-284 8.5 High 2026-04-09
CVE-2026-35442 Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries CWE-200 8.1 High 2026-04-06
CVE-2026-35441 Directus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limits CWE-400 6.5 Medium 2026-04-06
CVE-2026-35413 Directus GraphQL Schema SDL Disclosure Setting CWE-200 5.3 Medium 2026-04-06
CVE-2026-35412 Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwrite CWE-863 7.1 High 2026-04-06
CVE-2026-35411 Directus is an Open Redirect in Admin 2FA Setup Page CWE-601 4.3 Medium 2026-04-06
CVE-2026-35410 Directus has an Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow CWE-184 6.1 Medium 2026-04-06
CVE-2026-35409 Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import CWE-918 7.7 High 2026-04-06
CVE-2026-35408 Directus is Missing Cross-Origin Opener Policy CWE-346 8.7 High 2026-04-06
CVE-2026-26185 Directus Affected by User Enumeration via Password Reset Timing Attack CWE-203 5.3 Medium 2026-02-12
CVE-2026-22032 Directus has open redirect in SAML CWE-601 4.3 Medium 2026-01-08
CVE-2025-64749 Directus Vulnerable to Information Leakage in Existing Collections CWE-203 4.3 Medium 2025-11-13
CVE-2025-64748 Directus's conceal fields are searchable if read permissions enabled CWE-201 6.5 Medium 2025-11-13
CVE-2025-64747 Directus Vulnerable to Stored Cross-site Scripting CWE-20 5.5 Medium 2025-11-13
CVE-2025-64746 Directus has Improper Permission Handling on Deleted Fields CWE-284 4.6 Medium 2025-11-13
CVE-2025-55746 Directus allows unauthenticated file upload and file modification due to lacking input sanitization CWE-73 9.3 Critical 2025-08-20
CVE-2025-53889 Directus missing permission checks for manual trigger Flows CWE-287 6.5 Medium 2025-07-14
CVE-2025-53887 Directus's exact version number is exposed by the OpenAPI Spec CWE-200 5.3 Medium 2025-07-14
CVE-2025-53886 Directus doesn't redact tokens in Flow logs CWE-200 4.5 Medium 2025-07-14
CVE-2025-53885 Directus doesn't redact sensitive user data when logging via event hooks CWE-532 4.2 Medium 2025-07-14
CVE-2025-30353 Directus's webhook trigger flows can leak sensitive data CWE-200 8.6 High 2025-03-26
CVE-2025-30352 Directus `search` query parameter allows enumeration of non permitted fields CWE-200 5.3 Medium 2025-03-26
CVE-2025-30351 Suspended Directus user can continue to use session token to access API CWE-672 3.5 Low 2025-03-26
CVE-2025-30350 Directus's S3 assets become unavailable after a burst of HEAD requests CWE-770 5.3 Medium 2025-03-26
CVE-2025-30225 Directus's S3 assets become unavailable after a burst of malformed transformations CWE-770 5.3 Medium 2025-03-26
CVE-2025-27089 Overlapping policies allow update to non-allowed fields in directus CWE-863 5.4 Medium 2025-02-19

All 60 known CVE vulnerabilities affecting directus with full Chinese analysis, references, and POCs where available.