HIGH8.6npm
GHSA-fm3h-p9wm-h74h· CVE-2025-30353Directus's webhook trigger flows can leak sensitive data
Modified: 9/10/2026
package
npm/directus
pkg:npm/directus
MEDIUM5.4npm
GHSA-fr3w-2p22-6w7p· CVE-2024-28239URL Redirection to Untrusted Site in OAuth2/OpenID in directus
Modified: 9/10/2026
CRITICAL9.8npm
GHSA-g27j-74fp-xfpr· CVE-2022-26969Insecure default value for CORS configuration
Modified: 4/14/2025
MEDIUM5.4npm
GHSA-g65h-35f3-x2w3· CVE-2024-34709Directus Lacks Session Tokens Invalidation
Modified: 9/10/2026
HIGH7.6npm
GHSA-22rr-f3p8-5gf8Directus affected by VM2 sandbox escape vulnerability
Modified: 9/15/2023
LOW2.3npm
GHSA-2ccr-g2rv-h677· CVE-2024-28238Session Token in URL in directus
Modified: 9/10/2026
MEDIUM4.3npm
GHSA-3573-4c68-g8cc· CVE-2026-22032Directus has open redirect in SAML
Modified: 2/3/2026
HIGH8.1npm
GHSA-38hg-ww64-rrwc· CVE-2026-35442Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries
Modified: 4/7/2026
HIGH8.5npm
GHSA-393c-p46r-7c95· CVE-2026-39942Directus: Path Traversal and Broken Access Control in File Management API
Modified: 4/9/2026
MEDIUM4.1npm
GHSA-3fff-gqw3-vj86· CVE-2024-6534Directus has an insecure object reference via PATH presets
Modified: 3/20/2025
MEDIUM6.5npm
GHSA-3gvp-54v2-2jrp· CVE-2020-19850Directus API vulnerable to denial of service
Modified: 11/8/2023
HIGH7.5npm
GHSA-4hmq-ggrm-qfc6· CVE-2023-27474directus vulnerable to HTML Injection in Password Reset email to custom Reset URL
Modified: 9/10/2026
LOW3.5npm
GHSA-56p6-qw3c-fq2g· CVE-2025-30351Suspended Directus user can continue to use session token to access API
Modified: 9/10/2026
MEDIUM5.0npm
GHSA-5h75-pvq4-82c9· CVE-2022-23080Server-Side Request Forgery in Directus
Modified: 11/8/2023
MEDIUM5.3npm
GHSA-5mhg-wv8w-p59j· CVE-2024-27296Directus version number disclosure
Modified: 9/10/2026
HIGH7.5npm
GHSA-632p-p495-25m5· CVE-2024-36128Directus is soft-locked by providing a string value to random string util
Modified: 9/10/2026
MEDIUM5.0npm
GHSA-68g8-c275-xf2m· CVE-2024-46990Directus vulnerable to SSRF Loopback IP filter bypass
Modified: 9/18/2024
HIGH7.5npm
GHSA-6q22-g298-grjhDirectus: Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check Resolver
Modified: 4/4/2026
MEDIUM6.5npm
GHSA-77qm-wvqq-fg79· CVE-2022-36031Directus vulnerable to unhandled exception on illegal filename_disk value
Modified: 11/8/2023
MEDIUM6.5npm
GHSA-7cvf-pxgp-42fc· CVE-2025-53889Directus' insufficient permission checks can enable unauthenticated users to manually trigger Flows
Modified: 7/15/2025
MEDIUM5.3npm
GHSA-7wq3-jr35-275c· CVE-2025-30352Directus `search` query parameter allows enumeration of non permitted fields
Modified: 9/10/2026
HIGH7.5npm
GHSA-849r-qrwj-8rv4· CVE-2024-54151Directus allows unauthenticated access to WebSocket events and operations
Modified: 9/10/2026
MEDIUM6.5npm
GHSA-8jpw-gpr4-8cmh· CVE-2025-64748Directus's conceal fields are searchable if read permissions enabled
Modified: 11/15/2025
HIGH8.7npm
GHSA-8m32-p958-jg99· CVE-2026-35408Directus: Missing Cross-Origin Opener Policy
Modified: 4/7/2026
MEDIUM4.2npm
GHSA-8vg2-wf3q-mwv7· CVE-2023-28443directus vulnerable to Insertion of Sensitive Information into Log File
Modified: 11/8/2023
MEDIUM5.4npm
GHSA-99vm-5v2h-h6r6· CVE-2025-27089Directus allows updates to non-allowed fields due to overlapping policies
Modified: 2/19/2025
LOW3.4npm
GHSA-9qrm-48qf-r2rw· CVE-2024-6533Directus has a DOM-Based cross-site scripting (XSS) via layout_options
Modified: 8/14/2026
MEDIUM4.6npm
GHSA-9x5g-62gj-wqf2· CVE-2025-64746Directus has Improper Permission Handling on Deleted Fields
Modified: 11/14/2025
HIGH8.6npm
GHSA-c6w9-5g5j-jh2p· CVE-2026-61836Directus: Authorization-dependent response served from unsegmented cache key
Modified: 7/20/2026
MEDIUM6.1npm
GHSA-cf45-hxwj-4cfj· CVE-2026-35410Directus: Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow
Modified: 4/7/2026
HIGH7.4npm
GHSA-cff8-x7jv-4fm8· CVE-2024-45596Session is cached for OpenID and OAuth2 if `redirect` is not used
Modified: 11/17/2025
MEDIUM4.3npm
GHSA-cph6-524f-3hgr· CVE-2025-64749Directus Vulnerable to Information Leakage in Existing Collections
Modified: 11/15/2025
MEDIUM4.5npm
GHSA-f24x-rm6g-3w5v· CVE-2025-53886Directus tokens are not redacted in flow logs, exposing session credentials to all admin
Modified: 7/15/2025
MEDIUM5.7npm
GHSA-gggm-66rh-pp98· CVE-2023-38503Incorrect Permission Checking for GraphQL Subscriptions
Modified: 2/3/2026
HIGH7.5npm
GHSA-hmgw-9jrg-hf2m· CVE-2023-45820Directus crashes on invalid WebSocket message
Modified: 11/8/2023
MEDIUM6.3npm
GHSA-hxgm-ghmv-xjjm· CVE-2024-39701Directus incorrectly handles `_in` filter
Modified: 9/10/2026
MEDIUM5.0npm
GHSA-j3rg-3rgm-537h· CVE-2023-26492Directus vulnerable to Server-Side Request Forgery On File Import
Modified: 11/8/2023
HIGH7.7npm
GHSA-j5h6-vqc3-phqh· CVE-2026-61835Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
Modified: 7/20/2026
MEDIUM5.3npm
GHSA-j8xj-7jff-46mx· CVE-2025-30225Directus's S3 assets become unavailable after a burst of malformed transformations
Modified: 3/27/2025
HIGH7.5npm
GHSA-jgf4-vwc3-r46v· CVE-2024-39896Directus Allows Single Sign-On User Enumeration
Modified: 9/10/2026
MEDIUM5.3npm
GHSA-jr94-gj3h-c8rf· CVE-2026-26185Directus Vulnerable to User Enumeration via Password Reset Timing Attack
Modified: 2/13/2026
MEDIUM6.5npm
GHSA-m5q3-8wgf-x8xf· CVE-2023-27481Directus vulnerable to extraction of password hashes through export querying
Modified: 9/10/2026
CRITICAL9.3npm
GHSA-mv33-9f6j-pfmc· CVE-2025-55746Directus allows unauthenticated file upload and file modification due to lacking input sanitization
Modified: 8/20/2025
MEDIUM6.5npm
GHSA-mvv8-v4jj-g47j· CVE-2026-39943Directus: Sensitive fields exposed in revision history
Modified: 4/9/2026
MEDIUM4.9npm
GHSA-p8v3-m643-4xqx· CVE-2024-34708Directus allows redacted data extraction on the API through "alias"
Modified: 9/10/2026
MEDIUM6.5npm
GHSA-ph52-67fq-75wj· CVE-2026-35441Directus: GraphQL Alias Amplification Denial of Service Due to Missing Query Cost/Complexity Limits
Modified: 4/7/2026
MEDIUM5.0npm
GHSA-pmf4-v838-29hg· CVE-2025-24353Directus allows privilege escalation using Share feature
Modified: 2/11/2025
MEDIUM4.3npm
GHSA-q75c-4gmv-mg9x· CVE-2026-35411Directus: Open Redirect in Admin 2FA Setup Page
Modified: 4/7/2026
HIGH7.1npm
GHSA-qqmv-5p3g-px89· CVE-2026-35412Directus: TUS Upload Authorization Bypass Allows Arbitrary File Overwrite
Modified: 4/7/2026
HIGH8.2npm
GHSA-qw9g-7549-7wg5· CVE-2024-27295Directus has MySQL accent insensitive email matching
Modified: 9/10/2026
MEDIUM5.7npm
GHSA-r6wx-627v-gh2f· CVE-2024-54128Directus has an HTML Injection in Comment
Modified: 11/19/2025
MEDIUM5.3npm
GHSA-rmjh-cf9q-pv7q· CVE-2025-53887Directus' exact version number is exposed by the OpenAPI Spec
Modified: 7/15/2025
MEDIUM5.3npm
GHSA-rv78-qqrq-73m5· CVE-2025-30350Directus's S3 assets become unavailable after a burst of HEAD requests
Modified: 9/10/2026
MEDIUM5.5npm
GHSA-vv2v-pw69-8crf· CVE-2025-64747Directus is Vulnerable to Stored Cross-site Scripting
Modified: 11/14/2025
HIGH7.7npm
GHSA-wv3h-5fx7-966h· CVE-2026-35409Directus: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import
Modified: 4/7/2026
MEDIUM5.3npm
GHSA-wxwm-3fxv-mrvx· CVE-2026-35413Directus: GraphQL Schema SDL Disclosure Setting
Modified: 4/7/2026
MEDIUM4.2npm
GHSA-x3vm-88hf-gpxp· CVE-2025-53885Directus is vulnerable to sensitive data exposure as user data is not being redacted when logged
Modified: 7/15/2025
HIGH8.8npm
GHSA-xmjj-3c76-5w84· CVE-2022-24814Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in directus
Modified: 11/8/2023