CRITICAL9.8CVE-2022-26969Insecure default value for CORS configuration from 0, < 9.7.0
CRITICAL9.3CVE-2025-55746Directus allows unauthenticated file upload and file modification due to lacking input sanitization >= 10.8.0, < 11.9.3
HIGH8.8CVE-2022-24814Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in directus from 0, < 9.7.0
HIGH8.7Directus: Missing Cross-Origin Opener Policy
from 0, < 11.17.0
HIGH8.6Directus: Authorization-dependent response served from unsegmented cache key
from 0, < 12.0.0
HIGH8.6Directus's webhook trigger flows can leak sensitive data
>= 9.12.0, < 11.5.0
HIGH8.5Directus: Path Traversal and Broken Access Control in File Management API
from 0, < 11.17.0
HIGH8.2Directus has MySQL accent insensitive email matching
from 0, < 10.8.3
HIGH8.1Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries
from 0, < 11.17.0
HIGH7.7Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
from 0, < 12.0.0
HIGH7.7Directus: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import
from 0, < 11.16.0
HIGH7.5Directus allows unauthenticated access to WebSocket events and operations
>= 11.0.0, < 11.3.0
HIGH7.5Directus Allows Single Sign-On User Enumeration
>= 9.11, < 10.13.0
HIGH7.5Directus is soft-locked by providing a string value to random string util
from 0, < 10.11.2
HIGH7.5Directus crashes on invalid WebSocket message
>= 10.4.0, < 10.6.2
HIGH7.5directus vulnerable to HTML Injection in Password Reset email to custom Reset URL
from 0, < 9.23.0
HIGH7.4Session is cached for OpenID and OAuth2 if `redirect` is not used
from 0, < 10.13.3
HIGH7.1Directus: TUS Upload Authorization Bypass Allows Arbitrary File Overwrite
from 0, < 11.16.1
MEDIUM6.5Directus: GraphQL Alias Amplification Denial of Service Due to Missing Query Cost/Complexity Limits
from 0, < 11.17.0
MEDIUM6.5Directus: Sensitive fields exposed in revision history
from 0, < 11.17.0
MEDIUM6.5Directus's conceal fields are searchable if read permissions enabled
from 0, < 11.13.0
MEDIUM6.5Directus' insufficient permission checks can enable unauthenticated users to manually trigger Flows
from 0, < 11.9.0
MEDIUM6.5Directus API vulnerable to denial of service
>= 2.2.0, < 2.2.1
MEDIUM6.5Directus vulnerable to extraction of password hashes through export querying
from 0, < 9.16.0
MEDIUM6.5Directus vulnerable to unhandled exception on illegal filename_disk value
from 0, < 9.15.0
MEDIUM6.3Directus incorrectly handles `_in` filter
>= 9.23.0, < 10.6.0
MEDIUM6.1Directus: Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow
from 0, < 11.16.1
MEDIUM5.7Directus has an HTML Injection in Comment
>= 10.10.0, < 10.13.4
MEDIUM5.7Incorrect Permission Checking for GraphQL Subscriptions
>= 10.3.0, < 10.5.0
MEDIUM5.5Directus is Vulnerable to Stored Cross-site Scripting
from 0, < 11.13.0
MEDIUM5.4Directus allows updates to non-allowed fields due to overlapping policies
>= 11.0.0, < 11.1.2
MEDIUM5.4Directus Lacks Session Tokens Invalidation
>= 10.10.0, < 10.11.0
MEDIUM5.4URL Redirection to Untrusted Site in OAuth2/OpenID in directus
from 0, < 10.10.0
MEDIUM5.3Directus: GraphQL Schema SDL Disclosure Setting
from 0, < 11.16.1
MEDIUM5.3Directus Vulnerable to User Enumeration via Password Reset Timing Attack
from 0, < 11.14.1
MEDIUM5.3Directus' exact version number is exposed by the OpenAPI Spec
from 0, < 11.9.0
MEDIUM5.3Directus `search` query parameter allows enumeration of non permitted fields
>= 9.0.0-alpha.4, < 11.5.0
MEDIUM5.3Directus's S3 assets become unavailable after a burst of HEAD requests
>= 9.22, < 11.5.0
MEDIUM5.3Directus's S3 assets become unavailable after a burst of malformed transformations
>= 9.22.0, < 11.5.0
MEDIUM5.3Directus version number disclosure
from 0, < 10.8.3
MEDIUM5.0Directus allows privilege escalation using Share feature
from 0, < 11.2.0
MEDIUM5.0Directus vulnerable to SSRF Loopback IP filter bypass
from 0, < 10.13.3
MEDIUM5.0Directus vulnerable to Server-Side Request Forgery On File Import
from 0, < 9.23.0
MEDIUM5.0Server-Side Request Forgery in Directus
>= 9.0.0-beta.2, < 9.7.0
MEDIUM4.9Directus allows redacted data extraction on the API through "alias"
from 0, < 10.11.0
MEDIUM4.6Directus has Improper Permission Handling on Deleted Fields
from 0, < 11.13.0
MEDIUM4.5Directus tokens are not redacted in flow logs, exposing session credentials to all admin
from 0, < 11.9.0
MEDIUM4.3Directus: Open Redirect in Admin 2FA Setup Page
from 0, < 11.16.1
MEDIUM4.3Directus has open redirect in SAML
from 0, < 11.14.0
MEDIUM4.3Directus Vulnerable to Information Leakage in Existing Collections
from 0, < 11.13.0
MEDIUM4.2Directus is vulnerable to sensitive data exposure as user data is not being redacted when logged
>= 9.0.0, < 11.9.0
MEDIUM4.2directus vulnerable to Insertion of Sensitive Information into Log File
from 0, < 9.23.3
MEDIUM4.1Directus has an insecure object reference via PATH presets
from 0, < 10.13.2
LOW3.5Suspended Directus user can continue to use session token to access API
>= 10.10.0, < 11.5.0
LOW2.3Session Token in URL in directus
from 0, < 10.10.0