Skip to main content
cve.nowby Sazabi
← npm
npmPackage

directus

56 known vulnerabilities (2 critical, 15 high, 36 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
56 · 2 critical, 15 high, 36 medium, 2 low
Weekly downloads
26.3K
Dependents
2
Registry
npm

Advisories 56

  • Directus: Authorization-dependent response served from unsegmented cache key

    Affected: fixed in 12.0.0.

  • Directus: SSRF Protection Bypass via 0.0.0.0 in File Import

    Affected: fixed in 12.0.0.

  • CVE-2026-39943Medium 6.5

    Directus exposes sensitive fields in revision history

    Affected: fixed in 11.17.0.

  • Directus has a Path Traversal and Broken Access Control in File Management API

    Affected: fixed in 11.17.0.

  • Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries

    Affected: fixed in 11.17.0.

  • CVE-2026-35441Medium 6.5

    Directus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limits

    Affected: fixed in 11.17.0.

  • CVE-2026-35413Medium 5.3

    Directus GraphQL Schema SDL Disclosure Setting

    Affected: fixed in 11.16.1.

  • Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwrite

    Affected: fixed in 11.16.1.

  • CVE-2026-35411Medium 4.3

    Directus is an Open Redirect in Admin 2FA Setup Page

    Affected: fixed in 11.16.1.

  • CVE-2026-35410Medium 6.1

    Directus has an Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow

    Affected: fixed in 11.16.1.

  • Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import

    Affected: fixed in 11.16.0.

  • Directus is Missing Cross-Origin Opener Policy

    Affected: fixed in 11.17.0.

  • CVE-2026-26185Medium 5.3

    Directus Affected by User Enumeration via Password Reset Timing Attack

    Affected: fixed in 11.14.1.

  • CVE-2026-22032Medium 4.3

    Directus has open redirect in SAML

    Affected: fixed in 11.14.0.

  • CVE-2025-64749Medium 4.3

    Directus Vulnerable to Information Leakage in Existing Collections

    Affected: fixed in 11.13.0.

Show all 56 advisoriesShow fewer advisories
  • CVE-2025-64748Medium 6.5

    Directus's conceal fields are searchable if read permissions enabled

    Affected: fixed in 11.13.0.

  • CVE-2025-64747Medium 5.5

    Directus Vulnerable to Stored Cross-site Scripting

    Affected: fixed in 11.13.0.

  • CVE-2025-64746Medium 4.6

    Directus has Improper Permission Handling on Deleted Fields

    Affected: fixed in 11.13.0.

  • CVE-2025-55746Critical 9.3

    Directus allows unauthenticated file upload and file modification due to lacking input sanitization

    Affected: from 10.8.0, fixed in 11.9.3.

  • CVE-2025-53889Medium 6.5

    Directus missing permission checks for manual trigger Flows

    Affected: fixed in 11.9.0.

  • CVE-2025-53887Medium 5.3

    Directus's exact version number is exposed by the OpenAPI Spec

    Affected: fixed in 11.9.0.

  • CVE-2025-53886Medium 4.5

    Directus doesn't redact tokens in Flow logs

    Affected: fixed in 11.9.0.

  • CVE-2025-53885Medium 4.2

    Directus doesn't redact sensitive user data when logging via event hooks

    Affected: from 9.0.0, fixed in 11.9.0.

  • Directus's webhook trigger flows can leak sensitive data

    Affected: from 9.12.0, fixed in 11.5.0.

  • CVE-2025-30352Medium 5.3

    Directus `search` query parameter allows enumeration of non permitted fields

    Affected: from 9.0.0-alpha.4, fixed in 11.5.0.

  • Suspended Directus user can continue to use session token to access API

    Affected: from 10.10.0, fixed in 11.5.0.

  • CVE-2025-30350Medium 5.3

    Directus's S3 assets become unavailable after a burst of HEAD requests

    Affected: from 9.22, fixed in 11.5.0.

  • CVE-2025-30225Medium 5.3

    Directus's S3 assets become unavailable after a burst of malformed transformations

    Affected: from 9.22.0, fixed in 11.5.0.

  • CVE-2025-27089Medium 5.4

    Overlapping policies allow update to non-allowed fields in directus

    Affected: from 11.0.0, fixed in 11.1.2.

  • CVE-2025-24353Medium 5.0

    Directus privilege escalation vulnerability using Share feature

    Affected: fixed in 11.2.0.

  • Directus allows unauthenticated access to WebSocket events and operations

    Affected: from 11.0.0, fixed in 11.3.0.

  • CVE-2024-54128Medium 5.7

    Directus has an HTML Injection in Comment

    Affected: from 10.10.0, fixed in 10.13.4; from 11.0.0-rc.1, fixed in 11.2.2.

  • CVE-2024-46990Medium 5.0

    SSRF Loopback IP filter bypass in directus

    Affected: fixed in 10.13.3; from 11.0.0, fixed in 11.1.0.

  • Directus's session is cached for OpenID and OAuth2 if `redirect` is not used

    Affected: fixed in 10.13.3; from 11.0.0-rc.1, fixed in 11.1.0.

  • CVE-2024-6534Medium 4.3

    Directus 10.13.0 - Insecure object reference via PATH presets

    Affected: fixed in 10.13.2.

  • CVE-2024-6533Medium 5.4

    Directus 10.13.0 - DOM-Based cross-site scripting (XSS) via layout_options

    Affected: fixed in 11.3.3.

  • Directus allows SSO User Enumeration

    Affected: from 9.11, fixed in 10.13.0.

  • CVE-2024-39701Medium 6.3

    Directus Incorrectly handles _in` filter

    Affected: from 9.23.0, fixed in 10.6.0.

  • Directus is soft-locked by providing a string value to random string util

    Affected: fixed in 10.11.2.

  • CVE-2024-34709Medium 5.4

    Directus Lacks Session Tokens Invalidation

    Affected: from 10.10.0, fixed in 10.11.0.

  • CVE-2024-34708Medium 4.9

    Directus allows redacted data extraction on the API through "alias"

    Affected: fixed in 10.11.0.

  • Session Token in URL in directus

    Affected: fixed in 10.10.0.

  • CVE-2024-28239Medium 5.4

    URL Redirection to Untrusted Site in OAuth2/OpenID in directus

    Affected: fixed in 10.10.0.

  • CVE-2024-27296Medium 5.3

    Directus version number disclosure

    Affected: fixed in 10.8.3.

  • Directus MySQL accent insensitive email matching

    Affected: fixed in 10.8.3.

  • CVE-2023-45820Medium 5.9

    Directus crashes on invalid WebSocket message

    Affected: from 10.4.0, fixed in 10.6.2.

  • CVE-2023-38503Medium 5.7

    Directus has Incorrect Permission Checking for GraphQL Subscriptions

    Affected: from 10.3.0, fixed in 10.5.0.

  • CVE-2020-19850Medium 6.5

    An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests.

    Affected: from 2.2.0, fixed in 2.2.1.

  • CVE-2023-28443Medium 4.2

    directus vulnerable to Insertion of Sensitive Information into Log File

    Affected: fixed in 9.23.3.

  • CVE-2023-27481Medium 4.3

    Extract password hashes through export querying in directus

    Affected: fixed in 9.16.0.

  • HTML Injection in Password Reset email to custom Reset URL in directus

    Affected: fixed in 9.23.0.

  • CVE-2023-26492Medium 5.0

    Directus vulnerable to Server-Side Request Forgery On File Import

    Affected: fixed in 9.23.0.

  • CVE-2022-26969Critical 9.8

    In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.

    Affected: fixed in 9.7.0.

  • CVE-2022-36031Medium 6.5

    Unhandled exception on illegal filename_disk value

    Affected: fixed in 9.15.0.

  • directus - SSRF which leads to internal port scan

    Affected: from 9.0.0-beta.2, fixed in 9.7.0.

  • Cross-site Scripting in Directus

    Affected: fixed in 9.7.0.