Search for packages
| purl | pkg:npm/directus@11.9.3 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-8jpw-gpr4-8cmh
Aliases: CVE-2025-64748 |
Directus's conceal fields are searchable if read permissions enabled ## Summary A vulnerability allows authenticated users to search concealed/sensitive fields … |
Vulnerable |
|
GHSA-9x5g-62gj-wqf2
Aliases: CVE-2025-64746 |
Directus has Improper Permission Handling on Deleted Fields ### Summary Directus does not properly clean up field-level permissions when a … |
Vulnerable |
|
GHSA-cph6-524f-3hgr
Aliases: CVE-2025-64749 |
Directus Vulnerable to Information Leakage in Existing Collections ### Summary: An observable difference in error messaging was found in the … |
Vulnerable |
|
GHSA-vv2v-pw69-8crf
Aliases: CVE-2025-64747 |
Directus is Vulnerable to Stored Cross-site Scripting ### Summary A stored cross-site scripting (XSS) vulnerability exists that allows users with … |
Vulnerable |
|
GHSA-qqmv-5p3g-px89
Aliases: CVE-2026-35412 |
Directus: TUS Upload Authorization Bypass Allows Arbitrary File Overwrite ## Summary Directus' TUS resumable upload endpoint (`/files/tus`) allows any authenticated … |
Vulnerable |
|
GHSA-393c-p46r-7c95
Aliases: CVE-2026-39942 |
Directus: Path Traversal and Broken Access Control in File Management API ## Summary A broken access control vulnerability was identified … |
Vulnerable |
|
GHSA-6q22-g298-grjh
|
Directus: Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check Resolver ## Summary The GraphQL specification permits … |
Vulnerable |
|
GHSA-mvv8-v4jj-g47j
Aliases: CVE-2026-39943 |
Directus: Sensitive fields exposed in revision history ### Summary Directus stores revision records (in `directus_revisions`) whenever items are created or … |
Vulnerable |
|
GHSA-q75c-4gmv-mg9x
Aliases: CVE-2026-35411 |
Directus: Open Redirect in Admin 2FA Setup Page ### Summary Directus is vulnerable to an Open Redirect via the redirect … |
Vulnerable |
|
GHSA-38hg-ww64-rrwc
Aliases: CVE-2026-35442 |
Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries ### Summary Aggregate functions (`min`, `max`) applied to fields with … |
Vulnerable |
|
GHSA-cf45-hxwj-4cfj
Aliases: CVE-2026-35410 |
Directus: Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow ### Summary An open redirect vulnerability exists in the login … |
Vulnerable |
|
GHSA-ph52-67fq-75wj
Aliases: CVE-2026-35441 |
Directus: GraphQL Alias Amplification Denial of Service Due to Missing Query Cost/Complexity Limits ### Summary Directus' GraphQL endpoints (`/graphql` and … |
Vulnerable |
|
GHSA-wxwm-3fxv-mrvx
Aliases: CVE-2026-35413 |
Directus: GraphQL Schema SDL Disclosure Setting ## Summary When `GRAPHQL_INTROSPECTION=false` is configured, Directus correctly blocks standard GraphQL introspection queries (`__schema`, … |
Vulnerable |
|
GHSA-8m32-p958-jg99
Aliases: CVE-2026-35408 |
Directus: Missing Cross-Origin Opener Policy ## Summary Directus's Single Sign-On (SSO) login pages lacked a `Cross-Origin-Opener-Policy` (COOP) HTTP response header. … |
Vulnerable |
|
GHSA-wv3h-5fx7-966h
Aliases: CVE-2026-35409 |
Directus: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import ### Summary A Server-Side Request Forgery (SSRF) protection bypass … |
Vulnerable |
|
GHSA-jr94-gj3h-c8rf
Aliases: CVE-2026-26185 |
Directus Vulnerable to User Enumeration via Password Reset Timing Attack ### Summary A timing-based user enumeration vulnerability exists in the … |
Vulnerable |
|
GHSA-3573-4c68-g8cc
Aliases: CVE-2026-22032 |
Directus has open redirect in SAML ## Security Advisory: Open Redirect in Directus SAML Authentication ### Summary An open redirect … |
Vulnerable |
|
GHSA-c6w9-5g5j-jh2p
Aliases: CVE-2026-61836 |
Directus: Authorization-dependent response served from unsegmented cache key ## Summary When response caching is enabled (`CACHE_ENABLED=true`), the cache-key derivation in … |
Not vulnerable |
|
GHSA-j5h6-vqc3-phqh
Aliases: CVE-2026-61835 |
Directus: SSRF Protection Bypass via 0.0.0.0 in File Import ### Summary The SSRF protection on Directus's file-import-from-URL feature can be … |
Not vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-mv33-9f6j-pfmc
|
Directus allows unauthenticated file upload and file modification due to lacking input sanitization ## Summary A vulnerability exists in the … |
CVE-2025-55746
|