Directus vulnerabilities
61 CVEs and advisories name Directus as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-27089Overlapping policies allow update to non-allowed fields in directus
- CVE-2025-24353Directus privilege escalation vulnerability using Share feature
- CVE-2024-54151Directus allows unauthenticated access to WebSocket events and operations
- CVE-2024-54128Directus has an HTML Injection in Comment
- CVE-2024-47822Directus inserts access token from query string into logs
- CVE-2024-46990SSRF Loopback IP filter bypass in directus
- CVE-2024-45596Directus's session is cached for OpenID and OAuth2 if `redirect` is not used
- CVE-2024-6534Directus 10.13.0 - Insecure object reference via PATH presets
- CVE-2024-6533Directus 10.13.0 - DOM-Based cross-site scripting (XSS) via layout_options
- CVE-2024-39896Directus allows SSO User Enumeration
- CVE-2024-39895Directus GraphQL Field Duplication Denial of Service (DoS)
- CVE-2024-39701Directus Incorrectly handles _in` filter
- CVE-2024-39699Directus has a Blind SSRF On File Import
- CVE-2024-36128Directus is soft-locked by providing a string value to random string util
- CVE-2024-34709Directus Lacks Session Tokens Invalidation
- CVE-2024-34708Directus allows redacted data extraction on the API through "alias"
- CVE-2024-28238Session Token in URL in directus
- CVE-2024-28239URL Redirection to Untrusted Site in OAuth2/OpenID in directus
- CVE-2024-27296Directus version number disclosure
- CVE-2024-27295Directus MySQL accent insensitive email matching
- CVE-2023-45820Directus crashes on invalid WebSocket message
- CVE-2023-38503Directus has Incorrect Permission Checking for GraphQL Subscriptions
- CVE-2023-28443directus vulnerable to Insertion of Sensitive Information into Log File
- CVE-2023-27481Extract password hashes through export querying in directus
- CVE-2023-27474HTML Injection in Password Reset email to custom Reset URL in directus
- CVE-2023-26492Directus vulnerable to Server-Side Request Forgery On File Import
- CVE-2022-36031Unhandled exception on illegal filename_disk value
- CVE-2022-23080directus - SSRF which leads to internal port scan
- CVE-2022-24814Cross-site Scripting in Directus
- CVE-2022-22117Directus - Stored Cross-Site Scripting (XSS) in Profile Avatar Image