Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-v6mk-ybv3-tyc8
Vulnerability ID VCID-v6mk-ybv3-tyc8
Aliases CVE-2025-64747
GHSA-vv2v-pw69-8crf
Summary Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 11.13.0 that allows users with `upload files` and `edit item` permissions to inject malicious JavaScript through the Block Editor interface. Attackers can bypass Content Security Policy (CSP) restrictions by combining file uploads with iframe srcdoc attributes, resulting in persistent XSS execution. Version 11.13.0 fixes the issue.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-20 Improper Input Validation
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2025-64747
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2025-64747
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2025-64747
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-vv2v-pw69-8crf
cvssv3.1 5.5 https://github.com/directus/directus
generic_textual MODERATE https://github.com/directus/directus
cvssv3.1 5.5 https://github.com/directus/directus/commit/d23525317f0780f04aa1fe7a99171a358e43cb2e
generic_textual MODERATE https://github.com/directus/directus/commit/d23525317f0780f04aa1fe7a99171a358e43cb2e
ssvc Track https://github.com/directus/directus/commit/d23525317f0780f04aa1fe7a99171a358e43cb2e
cvssv3.1 5.5 https://github.com/directus/directus/security/advisories/GHSA-vv2v-pw69-8crf
cvssv3.1_qr MODERATE https://github.com/directus/directus/security/advisories/GHSA-vv2v-pw69-8crf
generic_textual MODERATE https://github.com/directus/directus/security/advisories/GHSA-vv2v-pw69-8crf
ssvc Track https://github.com/directus/directus/security/advisories/GHSA-vv2v-pw69-8crf
cvssv3.1 5.5 https://nvd.nist.gov/vuln/detail/CVE-2025-64747
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-64747
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-64747
https://github.com/directus/directus
CVE-2025-64747 https://nvd.nist.gov/vuln/detail/CVE-2025-64747
d23525317f0780f04aa1fe7a99171a358e43cb2e https://github.com/directus/directus/commit/d23525317f0780f04aa1fe7a99171a358e43cb2e
GHSA-vv2v-pw69-8crf https://github.com/advisories/GHSA-vv2v-pw69-8crf
GHSA-vv2v-pw69-8crf https://github.com/directus/directus/security/advisories/GHSA-vv2v-pw69-8crf
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L Found at https://github.com/directus/directus
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L Found at https://github.com/directus/directus/commit/d23525317f0780f04aa1fe7a99171a358e43cb2e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-13T21:33:34Z/ Found at https://github.com/directus/directus/commit/d23525317f0780f04aa1fe7a99171a358e43cb2e
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L Found at https://github.com/directus/directus/security/advisories/GHSA-vv2v-pw69-8crf
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-13T21:33:34Z/ Found at https://github.com/directus/directus/security/advisories/GHSA-vv2v-pw69-8crf
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2025-64747
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.1378
EPSS Score 0.00044
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:57:16.846810+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/64xxx/CVE-2025-64747.json 38.6.0