# directus (npm) vulnerabilities

56 known vulnerabilities (2 critical, 15 high, 36 medium, 2 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 12.6.1 (Nov 4, 2026): no advisory affects it
- Newest unaffected release: 12.6.1 (Nov 4, 2026), the latest release
- Weekly downloads: 26.3K
- Dependents: 2
- Releases: 347 since 9.0.0 (Nov 5, 2021)
- Registry: https://www.npmjs.com/package/directus
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-61836: 0.1.0-preview.1 to 12.0.0-rc.2 (12.0.0 is outside it)
- CVE-2026-61835: 0.1.0-preview.1 to 12.0.0-rc.2 (12.0.0 is outside it)
- CVE-2026-39943: 0.1.0-preview.1 to 11.16.1 (11.17.0 is outside it)
- CVE-2026-39942: 0.1.0-preview.1 to 11.16.1 (11.17.0 is outside it)
- CVE-2026-35442: 0.1.0-preview.1 to 11.16.1 (11.17.0 is outside it)
- CVE-2026-35441: 0.1.0-preview.1 to 11.16.1 (11.17.0 is outside it)
- CVE-2026-35413: 0.1.0-preview.1 to 11.16.0 (11.16.1 is outside it)
- CVE-2026-35412: 0.1.0-preview.1 to 11.16.0 (11.16.1 is outside it)
- CVE-2026-35411: 0.1.0-preview.1 to 11.16.0 (11.16.1 is outside it)
- CVE-2026-35410: 0.1.0-preview.1 to 11.16.0 (11.16.1 is outside it)
- CVE-2026-35409: 0.1.0-preview.1 to 11.15.4 (11.16.0 is outside it)
- CVE-2026-35408: 0.1.0-preview.1 to 11.16.1 (11.17.0 is outside it)
- CVE-2026-26185: 0.1.0-preview.1 to 11.14.0 (11.14.1 is outside it)
- CVE-2026-22032: 0.1.0-preview.1 to 11.13.4 (11.14.0 is outside it)
- CVE-2025-64749: 0.1.0-preview.1 to 11.12.0 (11.13.0 is outside it)
- CVE-2025-64748: 0.1.0-preview.1 to 11.12.0 (11.13.0 is outside it)
- CVE-2025-64747: 0.1.0-preview.1 to 11.12.0 (11.13.0 is outside it)
- CVE-2025-64746: 0.1.0-preview.1 to 11.12.0 (11.13.0 is outside it)
- CVE-2025-55746: 10.8.0 to 11.9.2 (11.9.3 is outside it)
- CVE-2025-53889: 0.1.0-preview.1 to 11.8.0 (11.9.0 is outside it)
- CVE-2025-53887: 0.1.0-preview.1 to 11.8.0 (11.9.0 is outside it)
- CVE-2025-53886: 0.1.0-preview.1 to 11.8.0 (11.9.0 is outside it)
- CVE-2025-53885: 9.0.0 to 11.8.0 (11.9.0 is outside it)
- CVE-2025-30353: 9.12.0 to 11.4.1 (11.5.0 is outside it)
- CVE-2025-30352: 9.0.0-alpha.5 to 11.4.1 (11.5.0 is outside it)
- CVE-2025-30351: 10.10.0 to 11.4.1 (11.5.0 is outside it)
- CVE-2025-30350: 9.22.0 to 11.4.1 (11.5.0 is outside it)
- CVE-2025-30225: 9.22.0 to 11.4.1 (11.5.0 is outside it)
- CVE-2025-27089: 11.0.0 to 11.1.1 (11.1.2 is outside it)
- CVE-2025-24353: 0.1.0-preview.1 to 11.1.2 (11.2.0 is outside it)
- CVE-2024-54151: 11.0.0 to 11.2.2 (11.3.0 is outside it)
- CVE-2024-54128: 10.10.0 to 10.13.2 (10.13.4 is outside it); 11.0.0-rc.1 to 11.2.1 (11.2.2 is outside it)
- CVE-2024-46990: 0.1.0-preview.1 to 10.13.2 (10.13.4 is outside it); 11.0.0 to 11.0.2 (11.1.0 is outside it)
- CVE-2024-45596: 0.1.0-preview.1 to 10.13.2 (10.13.4 is outside it); 11.0.0-rc.1 to 11.0.2 (11.1.0 is outside it)
- CVE-2024-6534: 0.1.0-preview.1 to 10.13.1 (10.13.2 is outside it)
- CVE-2024-6533: 0.1.0-preview.1 to 11.3.2 (11.3.3 is outside it)
- CVE-2024-39896: 9.11.0 to 10.12.1 (10.13.0 is outside it)
- CVE-2024-39701: 9.23.1 to 10.5.3 (10.6.0 is outside it)
- CVE-2024-36128: 0.1.0-preview.1 to 10.11.1 (10.11.2 is outside it)
- CVE-2024-34709: 10.10.0 to 10.10.7 (10.11.0 is outside it)
- CVE-2024-34708: 0.1.0-preview.1 to 10.10.7 (10.11.0 is outside it)
- CVE-2024-28238: 0.1.0-preview.1 to 10.9.3 (10.10.0 is outside it)
- CVE-2024-28239: 0.1.0-preview.1 to 10.9.3 (10.10.0 is outside it)
- CVE-2024-27296: 0.1.0-preview.1 to 10.8.2 (10.8.3 is outside it)
- CVE-2024-27295: 0.1.0-preview.1 to 10.8.2 (10.8.3 is outside it)
- CVE-2023-45820: 10.4.1 to 10.6.1 (10.6.2 is outside it)
- CVE-2023-38503: 10.3.0 to 10.4.3 (10.5.0 is outside it)
- CVE-2020-19850: no published release is affected
- CVE-2023-28443: 0.1.0-preview.1 to 9.23.1 (9.23.3 is outside it)
- CVE-2023-27481: 0.1.0-preview.1 to 9.15.1 (9.16.0 is outside it)
- CVE-2023-27474: 0.1.0-preview.1 to 9.22.4 (9.23.1 is outside it)
- CVE-2023-26492: 0.1.0-preview.1 to 9.22.4 (9.23.1 is outside it)
- CVE-2022-26969: 0.1.0-preview.1 to 9.6.0 (9.7.0 is outside it)
- CVE-2022-36031: 0.1.0-preview.1 to 9.14.5 (9.15.0 is outside it)
- CVE-2022-23080: 9.0.0-beta.2 to 9.6.0 (9.7.0 is outside it)
- CVE-2022-24814: 0.1.0-preview.1 to 9.6.0 (9.7.0 is outside it)

## Advisories (56)

### [CVE-2026-61836](https://cve.now/CVE-2026-61836): Directus: Authorization-dependent response served from unsegmented cache key

- Severity: High 8.6
- Published: Jul 15, 2026
- Affected: fixed in 12.0.0.
- Fixed in 12.0.0 (released Jun 10, 2026, 35 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 84% of directus downloads last week were affected versions (31.6K).

### [CVE-2026-61835](https://cve.now/CVE-2026-61835): Directus: SSRF Protection Bypass via 0.0.0.0 in File Import

- Severity: High 7.7
- Published: Jul 15, 2026
- Affected: fixed in 12.0.0.
- Fixed in 12.0.0 (released Jun 10, 2026, 35 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 84% of directus downloads last week were affected versions (31.6K).

### [CVE-2026-39943](https://cve.now/CVE-2026-39943): Directus exposes sensitive fields in revision history

- Severity: Medium 6.5
- Published: Apr 9, 2026
- Affected: fixed in 11.17.0.
- Fixed in 11.17.0 (released Mar 24, 2026, 16 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 72% of directus downloads last week were affected versions (27.1K).

### [CVE-2026-39942](https://cve.now/CVE-2026-39942): Directus has a Path Traversal and Broken Access Control in File Management API

- Severity: High 8.5
- Published: Apr 9, 2026
- Affected: fixed in 11.17.0.
- Fixed in 11.17.0 (released Mar 24, 2026, 16 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 72% of directus downloads last week were affected versions (27.1K).

### [CVE-2026-35442](https://cve.now/CVE-2026-35442): Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries

- Severity: High 8.1
- Published: Apr 6, 2026
- Affected: fixed in 11.17.0.
- Fixed in 11.17.0 (released Mar 24, 2026, 13 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 72% of directus downloads last week were affected versions (27.1K).

### [CVE-2026-35441](https://cve.now/CVE-2026-35441): Directus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limits

- Severity: Medium 6.5
- Published: Apr 6, 2026
- Affected: fixed in 11.17.0.
- Fixed in 11.17.0 (released Mar 24, 2026, 13 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 72% of directus downloads last week were affected versions (27.1K).

### [CVE-2026-35413](https://cve.now/CVE-2026-35413): Directus GraphQL Schema SDL Disclosure Setting

- Severity: Medium 5.3
- Published: Apr 6, 2026
- Affected: fixed in 11.16.1.
- Fixed in 11.16.1 (released Mar 10, 2026, 27 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 72% of directus downloads last week were affected versions (26.9K).

### [CVE-2026-35412](https://cve.now/CVE-2026-35412): Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwrite

- Severity: High 7.1
- Published: Apr 6, 2026
- Affected: fixed in 11.16.1.
- Fixed in 11.16.1 (released Mar 10, 2026, 27 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 72% of directus downloads last week were affected versions (26.9K).

### [CVE-2026-35411](https://cve.now/CVE-2026-35411): Directus is an Open Redirect in Admin 2FA Setup Page

- Severity: Medium 4.3
- Published: Apr 6, 2026
- Affected: fixed in 11.16.1.
- Fixed in 11.16.1 (released Mar 10, 2026, 27 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 72% of directus downloads last week were affected versions (26.9K).

### [CVE-2026-35410](https://cve.now/CVE-2026-35410): Directus has an Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow

- Severity: Medium 6.1
- Published: Apr 6, 2026
- Affected: fixed in 11.16.1.
- Fixed in 11.16.1 (released Mar 10, 2026, 27 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 72% of directus downloads last week were affected versions (26.9K).

### [CVE-2026-35409](https://cve.now/CVE-2026-35409): Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import

- Severity: High 7.7
- Published: Apr 6, 2026
- Affected: fixed in 11.16.0.
- Fixed in 11.16.0 (released Mar 4, 2026, 33 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 70% of directus downloads last week were affected versions (26.4K).

### [CVE-2026-35408](https://cve.now/CVE-2026-35408): Directus is Missing Cross-Origin Opener Policy

- Severity: High 8.7
- Published: Apr 6, 2026
- Affected: fixed in 11.17.0.
- Fixed in 11.17.0 (released Mar 24, 2026, 13 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 72% of directus downloads last week were affected versions (27.1K).

### [CVE-2026-26185](https://cve.now/CVE-2026-26185): Directus Affected by User Enumeration via Password Reset Timing Attack

- Severity: Medium 5.3
- Published: Feb 12, 2026
- Affected: fixed in 11.14.1.
- Fixed in 11.14.1 (released Jan 14, 2026, 29 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 68% of directus downloads last week were affected versions (25.5K).

### [CVE-2026-22032](https://cve.now/CVE-2026-22032): Directus has open redirect in SAML

- Severity: Medium 4.3
- Published: Jan 8, 2026
- Affected: fixed in 11.14.0.
- Fixed in 11.14.0 (released Dec 9, 2025, 30 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 67% of directus downloads last week were affected versions (24.9K).

### [CVE-2025-64749](https://cve.now/CVE-2025-64749): Directus Vulnerable to Information Leakage in Existing Collections

- Severity: Medium 4.3
- Published: Nov 13, 2025
- Affected: fixed in 11.13.0.
- Fixed in 11.13.0 (released Nov 4, 2025, 9 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 63% of directus downloads last week were affected versions (23.5K).

### [CVE-2025-64748](https://cve.now/CVE-2025-64748): Directus's conceal fields are searchable if read permissions enabled

- Severity: Medium 6.5
- Published: Nov 13, 2025
- Affected: fixed in 11.13.0.
- Fixed in 11.13.0 (released Nov 4, 2025, 9 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 63% of directus downloads last week were affected versions (23.5K).

### [CVE-2025-64747](https://cve.now/CVE-2025-64747): Directus Vulnerable to Stored Cross-site Scripting

- Severity: Medium 5.5
- Published: Nov 13, 2025
- Affected: fixed in 11.13.0.
- Fixed in 11.13.0 (released Nov 4, 2025, 9 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 63% of directus downloads last week were affected versions (23.5K).

### [CVE-2025-64746](https://cve.now/CVE-2025-64746): Directus has Improper Permission Handling on Deleted Fields

- Severity: Medium 4.6
- Published: Nov 13, 2025
- Affected: fixed in 11.13.0.
- Fixed in 11.13.0 (released Nov 4, 2025, 9 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 63% of directus downloads last week were affected versions (23.5K).

### [CVE-2025-55746](https://cve.now/CVE-2025-55746): Directus allows unauthenticated file upload and file modification due to lacking input sanitization

- Severity: Critical 9.3
- Published: Aug 20, 2025
- Affected: from 10.8.0, fixed in 11.9.3.
- Fixed in 11.9.3 (released Jul 9, 2025, 42 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 29% of directus downloads last week were affected versions (11K).

### [CVE-2025-53889](https://cve.now/CVE-2025-53889): Directus missing permission checks for manual trigger Flows

- Severity: Medium 6.5
- Published: Jul 14, 2025
- Affected: fixed in 11.9.0.
- Fixed in 11.9.0 (released Jun 25, 2025, 19 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 55% of directus downloads last week were affected versions (20.6K).

### [CVE-2025-53887](https://cve.now/CVE-2025-53887): Directus's exact version number is exposed by the OpenAPI Spec

- Severity: Medium 5.3
- Published: Jul 14, 2025
- Affected: fixed in 11.9.0.
- Fixed in 11.9.0 (released Jun 25, 2025, 19 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 55% of directus downloads last week were affected versions (20.6K).

### [CVE-2025-53886](https://cve.now/CVE-2025-53886): Directus doesn't redact tokens in Flow logs

- Severity: Medium 4.5
- Published: Jul 14, 2025
- Affected: fixed in 11.9.0.
- Fixed in 11.9.0 (released Jun 25, 2025, 19 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 55% of directus downloads last week were affected versions (20.6K).

### [CVE-2025-53885](https://cve.now/CVE-2025-53885): Directus doesn't redact sensitive user data when logging via event hooks

- Severity: Medium 4.2
- Published: Jul 14, 2025
- Affected: from 9.0.0, fixed in 11.9.0.
- Fixed in 11.9.0 (released Jun 25, 2025, 19 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 46% of directus downloads last week were affected versions (17.1K).

### [CVE-2025-30353](https://cve.now/CVE-2025-30353): Directus's webhook trigger flows can leak sensitive data

- Severity: High 8.6
- Published: Mar 26, 2025
- Affected: from 9.12.0, fixed in 11.5.0.
- Fixed in 11.5.0 (released Feb 26, 2025, 28 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 38% of directus downloads last week were affected versions (14.3K).

### [CVE-2025-30352](https://cve.now/CVE-2025-30352): Directus \`search\` query parameter allows enumeration of non permitted fields

- Severity: Medium 5.3
- Published: Mar 26, 2025
- Affected: from 9.0.0-alpha.4, fixed in 11.5.0.
- Fixed in 11.5.0 (released Feb 26, 2025, 28 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 51% of directus downloads last week were affected versions (19K).

### [CVE-2025-30351](https://cve.now/CVE-2025-30351): Suspended Directus user can continue to use session token to access API

- Severity: Low 3.5
- Published: Mar 26, 2025
- Affected: from 10.10.0, fixed in 11.5.0.
- Fixed in 11.5.0 (released Feb 26, 2025, 28 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 24% of directus downloads last week were affected versions (8.8K).

### [CVE-2025-30350](https://cve.now/CVE-2025-30350): Directus's S3 assets become unavailable after a burst of HEAD requests

- Severity: Medium 5.3
- Published: Mar 26, 2025
- Affected: from 9.22, fixed in 11.5.0.
- Fixed in 11.5.0 (released Feb 26, 2025, 28 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 33% of directus downloads last week were affected versions (12.4K).

### [CVE-2025-30225](https://cve.now/CVE-2025-30225): Directus's S3 assets become unavailable after a burst of malformed transformations

- Severity: Medium 5.3
- Published: Mar 26, 2025
- Affected: from 9.22.0, fixed in 11.5.0.
- Fixed in 11.5.0 (released Feb 26, 2025, 28 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 33% of directus downloads last week were affected versions (12.4K).

### [CVE-2025-27089](https://cve.now/CVE-2025-27089): Overlapping policies allow update to non-allowed fields in directus

- Severity: Medium 5.4
- Published: Feb 19, 2025
- Affected: from 11.0.0, fixed in 11.1.2.
- Fixed in 11.1.2 (released Oct 29, 2024, 113 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 2.9% of directus downloads last week were affected versions (1.1K).

### [CVE-2025-24353](https://cve.now/CVE-2025-24353): Directus privilege escalation vulnerability using Share feature

- Severity: Medium 5.0
- Published: Jan 23, 2025
- Affected: fixed in 11.2.0.
- Fixed in 11.2.0 (released Nov 5, 2024, 79 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 37% of directus downloads last week were affected versions (13.9K).

### [CVE-2024-54151](https://cve.now/CVE-2024-54151): Directus allows unauthenticated access to WebSocket events and operations

- Severity: High 7.5
- Published: Dec 9, 2024
- Affected: from 11.0.0, fixed in 11.3.0.
- Fixed in 11.3.0 (released Dec 2, 2024, 7 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 3.6% of directus downloads last week were affected versions (1.3K).

### [CVE-2024-54128](https://cve.now/CVE-2024-54128): Directus has an HTML Injection in Comment

- Severity: Medium 5.7
- Published: Dec 5, 2024
- Affected: from 10.10.0, fixed in 10.13.4; from 11.0.0-rc.1, fixed in 11.2.2.
- Fixed in 10.13.4 (released Dec 2, 2024, 3 days before disclosure) and 11.2.2 (released Nov 20, 2024, 15 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 8.2% of directus downloads last week were affected versions (3.1K).

### [CVE-2024-46990](https://cve.now/CVE-2024-46990): SSRF Loopback IP filter bypass in directus

- Severity: Medium 5.0
- Published: Sep 18, 2024
- Affected: fixed in 10.13.3; from 11.0.0, fixed in 11.1.0.
- Fixed in 10.13.4 (released Dec 2, 2024, 75 days after disclosure, the advisory names 10.13.3, which was never published) and 11.1.0 (released Sep 3, 2024, 15 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 34% of directus downloads last week were affected versions (12.6K).

### [CVE-2024-45596](https://cve.now/CVE-2024-45596): Directus's session is cached for OpenID and OAuth2 if \`redirect\` is not used

- Severity: High 7.4
- Published: Sep 10, 2024
- Affected: fixed in 10.13.3; from 11.0.0-rc.1, fixed in 11.1.0.
- Fixed in 10.13.4 (released Dec 2, 2024, 83 days after disclosure, the advisory names 10.13.3, which was never published) and 11.1.0 (released Sep 3, 2024, 7 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 34% of directus downloads last week were affected versions (12.6K).

### [CVE-2024-6534](https://cve.now/CVE-2024-6534): Directus 10.13.0 - Insecure object reference via PATH presets

- Severity: Medium 4.3
- Published: Aug 15, 2024
- Affected: fixed in 10.13.2.
- Fixed in 10.13.2 (released Aug 6, 2024, 9 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 33% of directus downloads last week were affected versions (12.2K).

### [CVE-2024-6533](https://cve.now/CVE-2024-6533): Directus 10.13.0 - DOM-Based cross-site scripting (XSS) via layout\_options

- Severity: Medium 5.4
- Published: Aug 15, 2024
- Affected: fixed in 11.3.3.
- Fixed in 11.3.3 (released Dec 16, 2024, 123 days after disclosure).
- The latest release, 12.6.1, is not affected.
- 38% of directus downloads last week were affected versions (14.3K).

### [CVE-2024-39896](https://cve.now/CVE-2024-39896): Directus allows SSO User Enumeration

- Severity: High 7.5
- Published: Jul 8, 2024
- Affected: from 9.11, fixed in 10.13.0.
- Fixed in 10.13.0 (released Jul 2, 2024, 6 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 18% of directus downloads last week were affected versions (6.8K).

### [CVE-2024-39701](https://cve.now/CVE-2024-39701): Directus Incorrectly handles \_in\` filter

- Severity: Medium 6.3
- Published: Jul 8, 2024
- Affected: from 9.23.0, fixed in 10.6.0.
- Fixed in 10.6.0 (released Aug 25, 2023, 318 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 5.1% of directus downloads last week were affected versions (1.9K).

### [CVE-2024-36128](https://cve.now/CVE-2024-36128): Directus is soft-locked by providing a string value to random string util

- Severity: High 7.5
- Published: Jun 3, 2024
- Affected: fixed in 10.11.2.
- Fixed in 10.11.2 (released May 28, 2024, 6 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 31% of directus downloads last week were affected versions (11.5K).

### [CVE-2024-34709](https://cve.now/CVE-2024-34709): Directus Lacks Session Tokens Invalidation

- Severity: Medium 5.4
- Published: May 13, 2024
- Affected: from 10.10.0, fixed in 10.11.0.
- Fixed in 10.11.0 (released May 7, 2024, 6 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 2% of directus downloads last week were affected versions (741).

### [CVE-2024-34708](https://cve.now/CVE-2024-34708): Directus allows redacted data extraction on the API through "alias"

- Severity: Medium 4.9
- Published: May 13, 2024
- Affected: fixed in 10.11.0.
- Fixed in 10.11.0 (released May 7, 2024, 6 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 30% of directus downloads last week were affected versions (11.4K).

### [CVE-2024-28238](https://cve.now/CVE-2024-28238): Session Token in URL in directus

- Severity: Low 2.3
- Published: Mar 12, 2024
- Affected: fixed in 10.10.0.
- Fixed in 10.10.0 (released Mar 5, 2024, 7 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 28% of directus downloads last week were affected versions (10.6K).

### [CVE-2024-28239](https://cve.now/CVE-2024-28239): URL Redirection to Untrusted Site in OAuth2/OpenID in directus

- Severity: Medium 5.4
- Published: Mar 12, 2024
- Affected: fixed in 10.10.0.
- Fixed in 10.10.0 (released Mar 5, 2024, 7 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 28% of directus downloads last week were affected versions (10.6K).

### [CVE-2024-27296](https://cve.now/CVE-2024-27296): Directus version number disclosure

- Severity: Medium 5.3
- Published: Mar 1, 2024
- Affected: fixed in 10.8.3.
- Fixed in 10.8.3 (released Dec 21, 2023, 71 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 27% of directus downloads last week were affected versions (10.2K).

### [CVE-2024-27295](https://cve.now/CVE-2024-27295): Directus MySQL accent insensitive email matching

- Severity: High 8.2
- Published: Mar 1, 2024
- Affected: fixed in 10.8.3.
- Fixed in 10.8.3 (released Dec 21, 2023, 71 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 27% of directus downloads last week were affected versions (10.2K).

### [CVE-2023-45820](https://cve.now/CVE-2023-45820): Directus crashes on invalid WebSocket message

- Severity: Medium 5.9
- Published: Oct 19, 2023
- Affected: from 10.4.0, fixed in 10.6.2.
- Fixed in 10.6.2 (released Sep 19, 2023, 30 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 2.1% of directus downloads last week were affected versions (792).

### [CVE-2023-38503](https://cve.now/CVE-2023-38503): Directus has Incorrect Permission Checking for GraphQL Subscriptions

- Severity: Medium 5.7
- Published: Jul 25, 2023
- Affected: from 10.3.0, fixed in 10.5.0.
- Fixed in 10.5.0 (released Jul 25, 2023, the day of disclosure).
- The latest release, 12.6.1, is not affected.
- 0.7% of directus downloads last week were affected versions (250).

### [CVE-2020-19850](https://cve.now/CVE-2020-19850): An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests.

- Severity: Medium 6.5
- Published: Apr 4, 2023
- Affected: from 2.2.0, fixed in 2.2.1.
- Fixed in 9.0.0 (released Nov 5, 2021, 515 days before disclosure, the advisory names 2.2.1, which was never published).
- The latest release, 12.6.1, is not affected.
- 0% of directus downloads last week were affected versions (0).

### [CVE-2023-28443](https://cve.now/CVE-2023-28443): directus vulnerable to Insertion of Sensitive Information into Log File

- Severity: Medium 4.2
- Published: Mar 23, 2023
- Affected: fixed in 9.23.3.
- Fixed in 9.23.3 (released Mar 23, 2023, the day of disclosure).
- The latest release, 12.6.1, is not affected.
- 20% of directus downloads last week were affected versions (7.4K).

### [CVE-2023-27481](https://cve.now/CVE-2023-27481): Extract password hashes through export querying in directus

- Severity: Medium 4.3
- Published: Mar 7, 2023
- Affected: fixed in 9.16.0.
- Fixed in 9.16.0 (released Aug 18, 2022, 201 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 16% of directus downloads last week were affected versions (5.9K).

### [CVE-2023-27474](https://cve.now/CVE-2023-27474): HTML Injection in Password Reset email to custom Reset URL in directus

- Severity: High 8.0
- Published: Mar 6, 2023
- Affected: fixed in 9.23.0.
- Fixed in 9.23.1 (released Mar 1, 2023, 5 days before disclosure, the advisory names 9.23.0, which was never published).
- The latest release, 12.6.1, is not affected.
- 20% of directus downloads last week were affected versions (7.3K).

### [CVE-2023-26492](https://cve.now/CVE-2023-26492): Directus vulnerable to Server-Side Request Forgery On File Import

- Severity: Medium 5.0
- Published: Mar 3, 2023
- Affected: fixed in 9.23.0.
- Fixed in 9.23.1 (released Mar 1, 2023, 2 days before disclosure, the advisory names 9.23.0, which was never published).
- The latest release, 12.6.1, is not affected.
- 20% of directus downloads last week were affected versions (7.3K).

### [CVE-2022-26969](https://cve.now/CVE-2022-26969): In Directus before 9.7.0, the default settings of CORS\_ORIGIN and CORS\_ENABLED are true.

- Severity: Critical 9.8
- Published: Dec 26, 2022
- Affected: fixed in 9.7.0.
- Fixed in 9.7.0 (released Mar 18, 2022, 283 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 12% of directus downloads last week were affected versions (4.6K).

### [CVE-2022-36031](https://cve.now/CVE-2022-36031): Unhandled exception on illegal filename\_disk value

- Severity: Medium 6.5
- Published: Aug 19, 2022
- Affected: fixed in 9.15.0.
- Fixed in 9.15.0 (released Aug 4, 2022, 15 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 15% of directus downloads last week were affected versions (5.8K).

### [CVE-2022-23080](https://cve.now/CVE-2022-23080): directus - SSRF which leads to internal port scan

- Severity: Unrated
- Published: Jun 22, 2022
- Affected: from 9.0.0-beta.2, fixed in 9.7.0.
- Fixed in 9.7.0 (released Mar 18, 2022, 96 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 9.7% of directus downloads last week were affected versions (3.6K).

### [CVE-2022-24814](https://cve.now/CVE-2022-24814): Cross-site Scripting in Directus

- Severity: High 8.8
- Published: Apr 4, 2022
- Affected: fixed in 9.7.0.
- Fixed in 9.7.0 (released Mar 18, 2022, 17 days before disclosure).
- The latest release, 12.6.1, is not affected.
- 12% of directus downloads last week were affected versions (4.6K).

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/directus
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.