Directus vulnerabilities
61 CVEs and advisories name Directus as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-126539Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface
- CVE-2026-10716Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation
- CVE-2026-61836Directus: Authorization-dependent response served from unsegmented cache key
- CVE-2026-61835Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
- CVE-2026-39943Directus exposes sensitive fields in revision history
- CVE-2026-39942Directus has a Path Traversal and Broken Access Control in File Management API
- CVE-2026-35442Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries
- CVE-2026-35441Directus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limits
- CVE-2026-35413Directus GraphQL Schema SDL Disclosure Setting
- CVE-2026-35412Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwrite
- CVE-2026-35411Directus is an Open Redirect in Admin 2FA Setup Page
- CVE-2026-35410Directus has an Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow
- CVE-2026-35409Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import
- CVE-2026-35408Directus is Missing Cross-Origin Opener Policy
- CVE-2026-26185Directus Affected by User Enumeration via Password Reset Timing Attack
- CVE-2026-22032Directus has open redirect in SAML
- CVE-2025-64749Directus Vulnerable to Information Leakage in Existing Collections
- CVE-2025-64748Directus's conceal fields are searchable if read permissions enabled
- CVE-2025-64747Directus Vulnerable to Stored Cross-site Scripting
- CVE-2025-64746Directus has Improper Permission Handling on Deleted Fields
- CVE-2025-55746Directus allows unauthenticated file upload and file modification due to lacking input sanitization
- CVE-2025-53889Directus missing permission checks for manual trigger Flows
- CVE-2025-53887Directus's exact version number is exposed by the OpenAPI Spec
- CVE-2025-53886Directus doesn't redact tokens in Flow logs
- CVE-2025-53885Directus doesn't redact sensitive user data when logging via event hooks
- CVE-2025-30353Directus's webhook trigger flows can leak sensitive data
- CVE-2025-30352Directus `search` query parameter allows enumeration of non permitted fields
- CVE-2025-30351Suspended Directus user can continue to use session token to access API
- CVE-2025-30350Directus's S3 assets become unavailable after a burst of HEAD requests
- CVE-2025-30225Directus's S3 assets become unavailable after a burst of malformed transformations