Monospace
Monospace Directus: vulnerabilidades y CVE
Monospace Directus tiene 56 vulnerabilidades publicadas, 18 de ellas en los últimos 12 meses. 2 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE56
Últimos 12 meses18
Críticas2
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-61836 | Alta (8.6) | 0.47% | — | 15 jul 2026 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key derivation in api/src/utils/get-cache-key.ts includes version, path,… |
| CVE-2026-61835 | Alta (7.7) | 0.41% | — | 15 jul 2026 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, the SSRF protection on Directus's file-import-from-URL feature can be bypassed using the address 0.0.0.0 because… |
| CVE-2026-39943 | Media (6.5) | 0.27% | — | 9 abr 2026 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus stores revision records (in directus_revisions) whenever items are created or updated. Due to the revision… |
| CVE-2026-39942 | Alta (8.8) | 0.36% | — | 9 abr 2026 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, the PATCH /files/{id} endpoint accepts a user-controlled filename_disk parameter. By setting this value to match the… |
| CVE-2026-35442 | Alta (8.1) | 0.43% | — | 6 abr 2026 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, aggregate functions (min, max) applied to fields with the conceal special type incorrectly return raw database values… |
| CVE-2026-35441 | Media (6.5) | 0.42% | — | 6 abr 2026 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus' GraphQL endpoints (/graphql and /graphql/system) did not deduplicate resolver invocations within a single… |
| CVE-2026-35413 | Media (5.3) | 0.36% | — | 6 abr 2026 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, when GRAPHQL_INTROSPECTION=false is configured, Directus correctly blocks standard GraphQL introspection queries… |
| CVE-2026-35412 | Alta (8.1) | 0.39% | — | 6 abr 2026 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus' TUS resumable upload endpoint (/files/tus) allows any authenticated user with basic file upload permissions to… |
| CVE-2026-35411 | Media (4.3) | 0.33% | — | 6 abr 2026 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus is vulnerable to an open redirect via the redirect query parameter on the /admin/tfa-setup page. When an… |
| CVE-2026-35410 | Media (6.1) | 0.32% | — | 6 abr 2026 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, an open redirect vulnerability exists in the login redirection logic. The isLoginRedirectAllowed function fails to… |
| CVE-2026-35409 | Alta (7.7) | 0.38% | — | 6 abr 2026 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.0, a Server-Side Request Forgery (SSRF) protection bypass has been identified and fixed in Directus. The IP address… |
| CVE-2026-35408 | Crítica (9.3) | 0.19% | — | 6 abr 2026 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus's Single Sign-On (SSO) login pages lacked a Cross-Origin-Opener-Policy (COOP) HTTP response header. Without… |
| CVE-2026-26185 | Media (5.3) | 0.43% | — | 12 feb 2026 | Directus is a real-time API and App dashboard for managing SQL database content. Before 11.14.1, a timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url… |
| CVE-2026-22032 | Media (6.1) | 0.23% | — | 8 ene 2026 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.14.0, an open redirect vulnerability exists in the Directus SAML authentication callback endpoint. During SAML… |
| CVE-2025-64749 | Media (4.3) | 0.33% | — | 13 nov 2025 | Directus is a real-time API and App dashboard for managing SQL database content. An observable difference in error messaging was found in the Directus REST API in versions of Directus prior to version 11.13.0. The… |
| CVE-2025-64748 | Media (6.5) | 0.28% | — | 13 nov 2025 | Directus is a real-time API and App dashboard for managing SQL database content. A vulnerability in versions prior to 11.13.0 allows authenticated users to search concealed/sensitive fields when they have read… |
| CVE-2025-64747 | Media (5.5) | 0.25% | — | 13 nov 2025 | Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 11.13.0 that allows users with `upload files` and `edit… |
| CVE-2025-64746 | Media (5.4) | 0.19% | — | 13 nov 2025 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.13.0, Directus does not properly clean up field-level permissions when a field is deleted. When a field is removed… |
| CVE-2025-55746 | Alta (7.5) | 1.3% | — | 20 ago 2025 | Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing… |
| CVE-2025-53889 | Media (6.5) | 0.41% | — | 15 jul 2025 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.9.0, Directus Flows with a manual trigger are not validating whether the user… |
| CVE-2025-53887 | Media (5.3) | 0.92% | — | 15 jul 2025 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, the exact Directus version number is incorrectly being used as OpenAPI Spec version… |
| CVE-2025-53886 | Media (4.5) | 0.40% | — | 15 jul 2025 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flows with the WebHook trigger all incoming request details are… |
| CVE-2025-53885 | Media (4.2) | 0.18% | — | 15 jul 2025 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flows to handle CRUD events for users it is possible to log the… |
| CVE-2025-30353 | Alta (7.5) | 0.52% | — | 26 mar 2025 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the "Webhook" trigger and the "Data of Last Operation" response… |
| CVE-2025-30352 | Media (5.3) | 0.37% | — | 26 mar 2025 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0-alpha.4 and prior to version 11.5.0, the `search` query parameter allows users with access to a collection to… |
| CVE-2025-30351 | Media (4.3) | 0.37% | — | 26 mar 2025 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.10.0 and prior to version 11.5.0, a suspended user can use the token generated in session auth mode to access the… |
| CVE-2025-30350 | Media (5.3) | 0.43% | — | 26 mar 2025 | Directus is a real-time API and App dashboard for managing SQL database content. The `@directus/storage-driver-s3` package starting in version 9.22.0 and prior to version 12.0.1, corresponding to Directus starting in… |
| CVE-2025-30225 | Media (5.3) | 0.43% | — | 26 mar 2025 | Directus is a real-time API and App dashboard for managing SQL database content. The `@directus/storage-driver-s3` package starting in version 9.22.0 and prior to version 12.0.1, corresponding to Directus starting in… |
| CVE-2025-27089 | Media (4.3) | 0.24% | — | 19 feb 2025 | Directus is a real-time API and App dashboard for managing SQL database content. In affected versions if there are two overlapping policies for the `update` action that allow access to different fields, instead of… |
| CVE-2025-24353 | Media (4.3) | 0.39% | — | 23 ene 2025 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.2.0, when sharing an item, a typical user can specify an arbitrary role. It allows the user to use a higher-privileged… |