# cve.now: Directus

The newest entries naming Directus as an affected vendor (up to 200), of 61 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-126539](https://cve.now/CVE-2026-126539.md): Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface (CVSS 9.2)
- [CVE-2026-10716](https://cve.now/CVE-2026-10716.md): Directus \<12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation (CVSS 7.5)
- [CVE-2026-61836](https://cve.now/CVE-2026-61836.md): Directus: Authorization-dependent response served from unsegmented cache key (CVSS 8.6)
- [CVE-2026-61835](https://cve.now/CVE-2026-61835.md): Directus: SSRF Protection Bypass via 0.0.0.0 in File Import (CVSS 7.7)
- [CVE-2026-39943](https://cve.now/CVE-2026-39943.md): Directus exposes sensitive fields in revision history (CVSS 6.5)
- [CVE-2026-39942](https://cve.now/CVE-2026-39942.md): Directus has a Path Traversal and Broken Access Control in File Management API (CVSS 8.5)
- [CVE-2026-35442](https://cve.now/CVE-2026-35442.md): Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries (CVSS 8.1)
- [CVE-2026-35441](https://cve.now/CVE-2026-35441.md): Directus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limits (CVSS 6.5)
- [CVE-2026-35413](https://cve.now/CVE-2026-35413.md): Directus GraphQL Schema SDL Disclosure Setting (CVSS 5.3)
- [CVE-2026-35412](https://cve.now/CVE-2026-35412.md): Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwrite (CVSS 7.1)
- [CVE-2026-35411](https://cve.now/CVE-2026-35411.md): Directus is an Open Redirect in Admin 2FA Setup Page (CVSS 4.3)
- [CVE-2026-35410](https://cve.now/CVE-2026-35410.md): Directus has an Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow (CVSS 6.1)
- [CVE-2026-35409](https://cve.now/CVE-2026-35409.md): Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import (CVSS 7.7)
- [CVE-2026-35408](https://cve.now/CVE-2026-35408.md): Directus is Missing Cross-Origin Opener Policy (CVSS 8.7)
- [CVE-2026-26185](https://cve.now/CVE-2026-26185.md): Directus Affected by User Enumeration via Password Reset Timing Attack (CVSS 5.3)
- [CVE-2026-22032](https://cve.now/CVE-2026-22032.md): Directus has open redirect in SAML (CVSS 4.3)
- [CVE-2025-64749](https://cve.now/CVE-2025-64749.md): Directus Vulnerable to Information Leakage in Existing Collections (CVSS 4.3)
- [CVE-2025-64748](https://cve.now/CVE-2025-64748.md): Directus's conceal fields are searchable if read permissions enabled (CVSS 6.5)
- [CVE-2025-64747](https://cve.now/CVE-2025-64747.md): Directus Vulnerable to Stored Cross-site Scripting (CVSS 5.5)
- [CVE-2025-64746](https://cve.now/CVE-2025-64746.md): Directus has Improper Permission Handling on Deleted Fields (CVSS 4.6)
- [CVE-2025-55746](https://cve.now/CVE-2025-55746.md): Directus allows unauthenticated file upload and file modification due to lacking input sanitization (CVSS 9.3)
- [CVE-2025-53889](https://cve.now/CVE-2025-53889.md): Directus missing permission checks for manual trigger Flows (CVSS 6.5)
- [CVE-2025-53887](https://cve.now/CVE-2025-53887.md): Directus's exact version number is exposed by the OpenAPI Spec (CVSS 5.3)
- [CVE-2025-53886](https://cve.now/CVE-2025-53886.md): Directus doesn't redact tokens in Flow logs (CVSS 4.5)
- [CVE-2025-53885](https://cve.now/CVE-2025-53885.md): Directus doesn't redact sensitive user data when logging via event hooks (CVSS 4.2)
- [CVE-2025-30353](https://cve.now/CVE-2025-30353.md): Directus's webhook trigger flows can leak sensitive data (CVSS 8.6)
- [CVE-2025-30352](https://cve.now/CVE-2025-30352.md): Directus \`search\` query parameter allows enumeration of non permitted fields (CVSS 5.3)
- [CVE-2025-30351](https://cve.now/CVE-2025-30351.md): Suspended Directus user can continue to use session token to access API (CVSS 3.5)
- [CVE-2025-30350](https://cve.now/CVE-2025-30350.md): Directus's S3 assets become unavailable after a burst of HEAD requests (CVSS 5.3)
- [CVE-2025-30225](https://cve.now/CVE-2025-30225.md): Directus's S3 assets become unavailable after a burst of malformed transformations (CVSS 5.3)
- [CVE-2025-27089](https://cve.now/CVE-2025-27089.md): Overlapping policies allow update to non-allowed fields in directus (CVSS 5.4)
- [CVE-2025-24353](https://cve.now/CVE-2025-24353.md): Directus privilege escalation vulnerability using Share feature (CVSS 5.0)
- [CVE-2024-54151](https://cve.now/CVE-2024-54151.md): Directus allows unauthenticated access to WebSocket events and operations (CVSS 7.5)
- [CVE-2024-54128](https://cve.now/CVE-2024-54128.md): Directus has an HTML Injection in Comment (CVSS 5.7)
- [CVE-2024-47822](https://cve.now/CVE-2024-47822.md): Directus inserts access token from query string into logs (CVSS 4.2)
- [CVE-2024-46990](https://cve.now/CVE-2024-46990.md): SSRF Loopback IP filter bypass in directus (CVSS 5.0)
- [CVE-2024-45596](https://cve.now/CVE-2024-45596.md): Directus's session is cached for OpenID and OAuth2 if \`redirect\` is not used (CVSS 7.4)
- [CVE-2024-6534](https://cve.now/CVE-2024-6534.md): Directus 10.13.0 - Insecure object reference via PATH presets (CVSS 4.3)
- [CVE-2024-6533](https://cve.now/CVE-2024-6533.md): Directus 10.13.0 - DOM-Based cross-site scripting (XSS) via layout\_options (CVSS 5.4)
- [CVE-2024-39896](https://cve.now/CVE-2024-39896.md): Directus allows SSO User Enumeration (CVSS 7.5)
- [CVE-2024-39895](https://cve.now/CVE-2024-39895.md): Directus GraphQL Field Duplication Denial of Service (DoS) (CVSS 6.5)
- [CVE-2024-39701](https://cve.now/CVE-2024-39701.md): Directus Incorrectly handles \_in\` filter (CVSS 6.3)
- [CVE-2024-39699](https://cve.now/CVE-2024-39699.md): Directus has a Blind SSRF On File Import (CVSS 5.0)
- [CVE-2024-36128](https://cve.now/CVE-2024-36128.md): Directus is soft-locked by providing a string value to random string util (CVSS 7.5)
- [CVE-2024-34709](https://cve.now/CVE-2024-34709.md): Directus Lacks Session Tokens Invalidation (CVSS 5.4)
- [CVE-2024-34708](https://cve.now/CVE-2024-34708.md): Directus allows redacted data extraction on the API through "alias" (CVSS 4.9)
- [CVE-2024-28238](https://cve.now/CVE-2024-28238.md): Session Token in URL in directus (CVSS 2.3)
- [CVE-2024-28239](https://cve.now/CVE-2024-28239.md): URL Redirection to Untrusted Site in OAuth2/OpenID in directus (CVSS 5.4)
- [CVE-2024-27296](https://cve.now/CVE-2024-27296.md): Directus version number disclosure (CVSS 5.3)
- [CVE-2024-27295](https://cve.now/CVE-2024-27295.md): Directus MySQL accent insensitive email matching (CVSS 8.2)
- [CVE-2023-45820](https://cve.now/CVE-2023-45820.md): Directus crashes on invalid WebSocket message (CVSS 5.9)
- [CVE-2023-38503](https://cve.now/CVE-2023-38503.md): Directus has Incorrect Permission Checking for GraphQL Subscriptions (CVSS 5.7)
- [CVE-2023-28443](https://cve.now/CVE-2023-28443.md): directus vulnerable to Insertion of Sensitive Information into Log File (CVSS 4.2)
- [CVE-2023-27481](https://cve.now/CVE-2023-27481.md): Extract password hashes through export querying in directus (CVSS 4.3)
- [CVE-2023-27474](https://cve.now/CVE-2023-27474.md): HTML Injection in Password Reset email to custom Reset URL in directus (CVSS 8.0)
- [CVE-2023-26492](https://cve.now/CVE-2023-26492.md): Directus vulnerable to Server-Side Request Forgery On File Import (CVSS 5.0)
- [CVE-2022-36031](https://cve.now/CVE-2022-36031.md): Unhandled exception on illegal filename\_disk value (CVSS 6.5)
- [CVE-2022-23080](https://cve.now/CVE-2022-23080.md): directus - SSRF which leads to internal port scan (no CVSS)
- [CVE-2022-24814](https://cve.now/CVE-2022-24814.md): Cross-site Scripting in Directus (CVSS 8.8)
- [CVE-2022-22117](https://cve.now/CVE-2022-22117.md): Directus - Stored Cross-Site Scripting (XSS) in Profile Avatar Image (CVSS 5.4)
- [CVE-2022-22116](https://cve.now/CVE-2022-22116.md): Directus - Stored Cross-Site Scripting (XSS) via SVG File Upload (CVSS 5.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/directus
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.