pkg:npm/directus

All known vulnerabilities

• CRITICAL9.8CVE-2022-26969Insecure default value for CORS configuration
  from 0, < 9.7.0
• CRITICAL9.3CVE-2025-55746Directus allows unauthenticated file upload and file modification due to lacking input sanitization
  >= 10.8.0, < 11.9.3
• HIGH8.8Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in directus
  from 0, < 9.7.0
• HIGH8.7Directus: Missing Cross-Origin Opener Policy
  from 0, < 11.17.0
• HIGH8.6Directus's webhook trigger flows can leak sensitive data
  >= 9.12.0, < 11.5.0
• HIGH8.5Directus: Path Traversal and Broken Access Control in File Management API
  from 0, < 11.17.0
• HIGH8.2Directus has MySQL accent insensitive email matching
  from 0, < 10.8.3
• HIGH8.1Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries
  from 0, < 11.17.0
• HIGH7.7Directus: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import
  from 0, < 11.16.0
• HIGH7.5Directus allows unauthenticated access to WebSocket events and operations
  >= 11.0.0, < 11.3.0
• HIGH7.5Directus Allows Single Sign-On User Enumeration
  >= 9.11, < 10.13.0
• HIGH7.5Directus is soft-locked by providing a string value to random string util
  from 0, < 10.11.2
• HIGH7.5Directus crashes on invalid WebSocket message
  >= 10.4.0, < 10.6.2
• HIGH7.5directus vulnerable to HTML Injection in Password Reset email to custom Reset URL
  from 0, < 9.23.0
• HIGH7.4Session is cached for OpenID and OAuth2 if `redirect` is not used
  from 0, < 10.13.3
• HIGH7.1Directus: TUS Upload Authorization Bypass Allows Arbitrary File Overwrite
  from 0, < 11.16.1
• MEDIUM6.5Directus: GraphQL Alias Amplification Denial of Service Due to Missing Query Cost/Complexity Limits
  from 0, < 11.17.0
• MEDIUM6.5Directus: Sensitive fields exposed in revision history
  from 0, < 11.17.0
• MEDIUM6.5Directus's conceal fields are searchable if read permissions enabled
  from 0, < 11.13.0
• MEDIUM6.5Directus' insufficient permission checks can enable unauthenticated users to manually trigger Flows
  from 0, < 11.9.0
• MEDIUM6.5Directus API vulnerable to denial of service
  >= 2.2.0, < 2.2.1
• MEDIUM6.5Directus vulnerable to extraction of password hashes through export querying
  from 0, < 9.16.0
• MEDIUM6.5Directus vulnerable to unhandled exception on illegal filename_disk value
  from 0, < 9.15.0
• MEDIUM6.3Directus incorrectly handles `_in` filter
  >= 9.23.0, < 10.6.0
• MEDIUM6.1Directus: Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow
  from 0, < 11.16.1
• MEDIUM5.7Directus has an HTML Injection in Comment
  >= 10.10.0, < 10.13.4
• MEDIUM5.7Incorrect Permission Checking for GraphQL Subscriptions
  >= 10.3.0, < 10.5.0
• MEDIUM5.5Directus is Vulnerable to Stored Cross-site Scripting
  from 0, < 11.13.0
• MEDIUM5.4Directus allows updates to non-allowed fields due to overlapping policies
  >= 11.0.0, < 11.1.2
• MEDIUM5.4Directus Lacks Session Tokens Invalidation
  >= 10.10.0, < 10.11.0
• MEDIUM5.4URL Redirection to Untrusted Site in OAuth2/OpenID in directus
  from 0, < 10.10.0
• MEDIUM5.3Directus: GraphQL Schema SDL Disclosure Setting
  from 0, < 11.16.1
• MEDIUM5.3Directus Vulnerable to User Enumeration via Password Reset Timing Attack
  from 0, < 11.14.1
• MEDIUM5.3Directus' exact version number is exposed by the OpenAPI Spec
  from 0, < 11.9.0
• MEDIUM5.3Directus `search` query parameter allows enumeration of non permitted fields
  >= 9.0.0-alpha.4, < 11.5.0
• MEDIUM5.3Directus's S3 assets become unavailable after a burst of HEAD requests
  >= 9.22, < 11.5.0
• MEDIUM5.3Directus's S3 assets become unavailable after a burst of malformed transformations
  >= 9.22.0, < 11.5.0
• MEDIUM5.3Directus version number disclosure
  from 0, < 10.8.3
• MEDIUM5.0Directus allows privilege escalation using Share feature
  from 0, < 11.2.0
• MEDIUM5.0Directus vulnerable to SSRF Loopback IP filter bypass
  from 0, < 10.13.3
• MEDIUM5.0Directus vulnerable to Server-Side Request Forgery On File Import
  from 0, < 9.23.0
• MEDIUM5.0Server-Side Request Forgery in Directus
  >= 9.0.0-beta.2, < 9.7.0
• MEDIUM4.9Directus allows redacted data extraction on the API through "alias"
  from 0, < 10.11.0
• MEDIUM4.6Directus has Improper Permission Handling on Deleted Fields
  from 0, < 11.13.0
• MEDIUM4.5Directus tokens are not redacted in flow logs, exposing session credentials to all admin
  from 0, < 11.9.0
• MEDIUM4.3Directus: Open Redirect in Admin 2FA Setup Page
  from 0, < 11.16.1
• MEDIUM4.3Directus has open redirect in SAML
  from 0, < 11.14.0
• MEDIUM4.3Directus Vulnerable to Information Leakage in Existing Collections
  from 0, < 11.13.0
• MEDIUM4.2Directus is vulnerable to sensitive data exposure as user data is not being redacted when logged
  >= 9.0.0, < 11.9.0
• MEDIUM4.2directus vulnerable to Insertion of Sensitive Information into Log File
  from 0, < 9.23.3
• MEDIUM4.1Directus has an insecure object reference via PATH presets
  from 0, < 10.13.2
• LOW3.5Suspended Directus user can continue to use session token to access API
  >= 10.10.0, < 11.5.0
• LOW2.3Session Token in URL in directus
  from 0, < 10.10.0