Search for packages
| purl | pkg:npm/directus@11.5.1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-5u8r-s8tz-guhm
Aliases: CVE-2025-55746 GHSA-mv33-9f6j-pfmc |
Affected by 4 other vulnerabilities. |
|
|
VCID-7zt3-dcnm-hqfb
Aliases: CVE-2025-64746 GHSA-9x5g-62gj-wqf2 |
Directus has Improper Permission Handling on Deleted Fields Directus does not properly clean up field-level permissions when a field is deleted. If a new field with the same name is created later, the system automatically re-applies the old permissions, which can lead to unauthorized access. |
Affected by 0 other vulnerabilities. |
|
VCID-bh2g-b9dd-d3d9
Aliases: CVE-2025-53886 GHSA-f24x-rm6g-3w5v |
Affected by 5 other vulnerabilities. |
|
|
VCID-hpbn-rr29-2yck
Aliases: CVE-2025-53885 GHSA-x3vm-88hf-gpxp |
Affected by 5 other vulnerabilities. |
|
|
VCID-jjth-fmsp-rfcj
Aliases: CVE-2025-64747 GHSA-vv2v-pw69-8crf |
Directus is Vulnerable to Stored Cross-site Scripting A stored cross-site scripting (XSS) vulnerability exists that allows users with `upload files` and `edit item` permissions to inject malicious JavaScript through the Block Editor interface. Attackers can bypass Content Security Policy (CSP) restrictions by combining file uploads with iframe srcdoc attributes, resulting in persistent XSS execution. |
Affected by 0 other vulnerabilities. |
|
VCID-na3v-me78-aqcg
Aliases: CVE-2025-64749 GHSA-cph6-524f-3hgr |
Directus Vulnerable to Information Leakage in Existing Collections An observable difference in error messaging was found in the Directus REST API. The `/items/{collection}` API returns different error messages for these two cases: 1. A user tries to access an existing collection which they are not authorized to access. 2. A user tries to access a non-existing collection. The two differing error messages leak the existence of collections to users which are not authorized to access these collections. |
Affected by 0 other vulnerabilities. |
|
VCID-nvha-b5tb-dqdt
Aliases: CVE-2025-64748 GHSA-8jpw-gpr4-8cmh |
Directus's conceal fields are searchable if read permissions enabled A vulnerability allows authenticated users to search concealed/sensitive fields when they have read permissions. While actual values remain masked (`****`), successful matches can be detected through returned records, enabling enumeration attacks on sensitive data. |
Affected by 0 other vulnerabilities. |
|
VCID-pwt9-krmn-7kdd
Aliases: CVE-2025-53889 GHSA-7cvf-pxgp-42fc |
Affected by 5 other vulnerabilities. |
|
|
VCID-wn2j-dtpz-hye1
Aliases: CVE-2025-53887 GHSA-rmjh-cf9q-pv7q |
Affected by 5 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||