Directus - Unauthenticated File Modification

Directus versions from 10.8.0 before 11.9.3 allow unauthenticated attackers to modify the contents of an existing file when a valid file UUID is known. The PATCH /files/id endpoint processes multipart file uploads without proper authentication, allowing file content replacement despite returning ...

Directus < 11.9.0 - Version Disclosure

Directus versions from 9.0.0 before 11.9.0 expose the exact running version through the OpenAPI specification returned by the unauthenticated /server/specs/oas endpoint. The version is placed in the OpenAPI info.version field, letting an unauthenticated attacker fingerprint the precise Directus...

directus-preso

The reveal.js files for my presentation about my Directus bug...

directus-security

directus-security Audit any Directus instance for the misconfigurations that actually leak data — public-role read exposure, user enumeration, unauthenticated version/schema leaks, GraphQL introspection, and the search-param field-enumeration oracle — and prove each one live with an anonymous...

@depup/directus (12.3.0-depup.0), directus (12.3.0) potentially affected by unknown CVE via @directus/api (39.0.0)

@directus/api NPM version 39.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @directus/api and may be impacted: - @depup/directus 12.3.0-depup.0 - directus 12.3.0 Source cves: unknown CVE Source advisory: MEND:WS-2026-0110...

@depup/directus (12.3.0-depup.0), directus (12.3.0) potentially affected by unknown CVE via @directus/api (39.0.0)

@directus/api NPM version 39.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @directus/api and may be impacted: - @depup/directus 12.3.0-depup.0 - directus 12.3.0 Source cves: unknown CVE Source advisory: MEND:WS-2026-0109...

@cesarechazu/directus-extension-generate-pdf (1.0.6), registri-dynamic-pdf (0.1.1) potentially affected by CVE-2026-82868 via @pdfme/schemas (>=4.5.2, <=5.5.8)

@pdfme/schemas NPM version =4.5.2, =5.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on @pdfme/schemas and may be impacted: - @cesarechazu/directus-extension-generate-pdf 1.0.6 - registri-dynamic-pdf 0.1.1 Source cves: CVE-2026-82868 Source advisory:...

@cesarechazu/directus-extension-generate-pdf (1.0.6), registri-dynamic-pdf (0.1.1) potentially affected by CVE-2026-82867 via @pdfme/schemas (>=4.5.2, <=5.5.8)

@pdfme/schemas NPM version =4.5.2, =5.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on @pdfme/schemas and may be impacted: - @cesarechazu/directus-extension-generate-pdf 1.0.6 - registri-dynamic-pdf 0.1.1 Source cves: CVE-2026-82867 Source advisory:...

@cesarechazu/directus-extension-generate-pdf (1.0.6), registri-dynamic-pdf (0.1.1) potentially affected by CVE-2026-82865 via @pdfme/schemas (>=4.5.2, <=5.5.8)

@pdfme/schemas NPM version =4.5.2, =5.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on @pdfme/schemas and may be impacted: - @cesarechazu/directus-extension-generate-pdf 1.0.6 - registri-dynamic-pdf 0.1.1 Source cves: CVE-2026-82865 Source advisory:...

CVE-2026-10716

Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields.type value starts with geometry but contains attacker-controlled SQL...

CVE-2026-10716 Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation

Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields.type value starts with geometry but contains attacker-controlled SQL...

CVE-2026-10716 Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation

Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields.type value starts with geometry but contains attacker-controlled SQL...

@altipla/directus-sdk-utils (0.7.2), @bicou/directus-extension-imagga (>=1.6.3, <=1.6.6) +16 more potentially affected by CVE-2026-10716 via directus (>=9.6.0, <=12.0.2)

directus NPM version =9.6.0, =1.6.3, =11.16.1-depup.0, =15.0.0, =1.2.2, =0.1.0, =1.0.0, =1.0.1, =1.0.12 and more Source cves: CVE-2026-10716 Source advisory: MEND:CVE-2026-10716...

CVE-2026-10716

Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields.type value starts with geometry but contains attacker-controlled SQL...

CVE-2026-10716

Directus: Authenticated SQL injection in collection creation when using PostgreSQL with PostGIS. A admin can craft a collection with a geometry field where fields[].type starts with geometry but includes attacker-controlled SQL syntax after the geometry subtype, enabling time-based SQL injection....

EUVD-2026-53519

Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields.type value starts with geometry but contains attacker-controlled SQL...

CVE-2026-10716 Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation

Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields.type value starts with geometry but contains attacker-controlled SQL...

PT-2026-68256

Name of the Vulnerable Software and Affected Versions Directus versions prior to 12.1.0 Description An authenticated SQL injection exists in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can exploit this by creating a collection with a...

CVE-2026-10716: Improper Neutralization of Special Elements used in an SQL Command

Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields.type value starts with geometry but contains attacker-controlled SQL...

@directus/api (>=36.0.0-rc.0, <=36.0.0-rc.1) potentially affected by CVE-2026-61836 via directus (>=12.0.0-rc.1, <=12.0.0-rc.2)

directus NPM version =12.0.0-rc.1, =36.0.0-rc.0, =36.0.0-rc.1 Source cves: CVE-2026-61836 Source advisory: OSV:GHSA-C6W9-5G5J-JH2P...