Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@directus/api

12 known vulnerabilities (1 critical, 2 high, 8 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
12 · 1 critical, 2 high, 8 medium, 1 low
Registry
npm

Advisories 12

  • CVE-2026-26185Medium 5.3

    Directus Affected by User Enumeration via Password Reset Timing Attack

    Affected: fixed in 32.2.0.

  • CVE-2026-22032Medium 4.3

    Directus has open redirect in SAML

    Affected: fixed in 32.1.1.

  • CVE-2025-64749Medium 4.3

    Directus Vulnerable to Information Leakage in Existing Collections

    Affected: fixed in 32.0.0.

  • CVE-2025-64748Medium 6.5

    Directus's conceal fields are searchable if read permissions enabled

    Affected: fixed in 32.0.0.

  • CVE-2025-55746Critical 9.3

    Directus allows unauthenticated file upload and file modification due to lacking input sanitization

    Affected: from 14.1.0, fixed in 28.0.2.

  • Suspended Directus user can continue to use session token to access API

    Affected: from 18.0.0, fixed in 24.0.1.

  • CVE-2025-27089Medium 5.4

    Overlapping policies allow update to non-allowed fields in directus

    Affected: from 22.0.0, fixed in 23.1.0.

  • Directus allows unauthenticated access to WebSocket events and operations

    Affected: from 22.2.0, fixed in 23.2.0.

  • CVE-2024-47822Medium 4.2

    Directus inserts access token from query string into logs

    Affected: fixed in 21.0.0.

  • CVE-2024-46990Medium 5.0

    SSRF Loopback IP filter bypass in directus

    Affected: fixed in 21.0.0; from 22.0.0, fixed in 22.1.1.

  • Directus's session is cached for OpenID and OAuth2 if `redirect` is not used

    Affected: fixed in 21.0.1; from 22.0.0, fixed in 22.2.0.

  • CVE-2024-39699Medium 5.0

    Directus has a Blind SSRF On File Import

    Affected: fixed in 17.1.0.