Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-662k-n18g-mybg
Vulnerability ID VCID-662k-n18g-mybg
Aliases CVE-2025-53887
GHSA-rmjh-cf9q-pv7q
Summary Directus' exact version number is exposed by the OpenAPI Spec ### Summary The exact Directus version number is incorrectly being used as OpenAPI Spec version this means that it is being exposed by the `/server/specs/oas` endpoint without authentication. ### Impact With the exact version information a malicious attacker can look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00316 https://api.first.org/data/v1/epss?cve=CVE-2025-53887
cvssv3.1 5.3 https://github.com/directus/directus
generic_textual MODERATE https://github.com/directus/directus
cvssv3.1 5.3 https://github.com/directus/directus/commit/e74f3e4e92edc33b5f83eefb001a3d2a85af17a3
generic_textual MODERATE https://github.com/directus/directus/commit/e74f3e4e92edc33b5f83eefb001a3d2a85af17a3
ssvc Track https://github.com/directus/directus/commit/e74f3e4e92edc33b5f83eefb001a3d2a85af17a3
cvssv3.1 5.3 https://github.com/directus/directus/pull/25353
generic_textual MODERATE https://github.com/directus/directus/pull/25353
ssvc Track https://github.com/directus/directus/pull/25353
cvssv3.1 5.3 https://github.com/directus/directus/releases/tag/v11.9.0
generic_textual MODERATE https://github.com/directus/directus/releases/tag/v11.9.0
ssvc Track https://github.com/directus/directus/releases/tag/v11.9.0
cvssv3.1 5.3 https://github.com/directus/directus/security/advisories/GHSA-rmjh-cf9q-pv7q
generic_textual MODERATE https://github.com/directus/directus/security/advisories/GHSA-rmjh-cf9q-pv7q
ssvc Track https://github.com/directus/directus/security/advisories/GHSA-rmjh-cf9q-pv7q
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2025-53887
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-53887
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-53887
https://github.com/directus/directus
https://github.com/directus/directus/commit/e74f3e4e92edc33b5f83eefb001a3d2a85af17a3
https://github.com/directus/directus/pull/25353
https://github.com/directus/directus/releases/tag/v11.9.0
https://github.com/directus/directus/security/advisories/GHSA-rmjh-cf9q-pv7q
https://nvd.nist.gov/vuln/detail/CVE-2025-53887
GHSA-rmjh-cf9q-pv7q https://github.com/advisories/GHSA-rmjh-cf9q-pv7q
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/directus/directus
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/directus/directus/commit/e74f3e4e92edc33b5f83eefb001a3d2a85af17a3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-07-15T13:45:18Z/ Found at https://github.com/directus/directus/commit/e74f3e4e92edc33b5f83eefb001a3d2a85af17a3
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/directus/directus/pull/25353
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-07-15T13:45:18Z/ Found at https://github.com/directus/directus/pull/25353
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/directus/directus/releases/tag/v11.9.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-07-15T13:45:18Z/ Found at https://github.com/directus/directus/releases/tag/v11.9.0
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/directus/directus/security/advisories/GHSA-rmjh-cf9q-pv7q
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-07-15T13:45:18Z/ Found at https://github.com/directus/directus/security/advisories/GHSA-rmjh-cf9q-pv7q
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-53887
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.54914
EPSS Score 0.00316
Published At May 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-29T09:02:03.732985+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-rmjh-cf9q-pv7q/GHSA-rmjh-cf9q-pv7q.json 38.6.0