CVE-2025-53885

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flows to handle CRUD events for users it is possible to log the incoming data to console using the "Log to Console" operation and a template...

@bicou/directus-extension-imagga (>=1.6.3, <=1.6.6), @directus/api (>=15.0.0, <=27.1.0) +9 more potentially affected by CVE-2025-53885 via directus (>=9.6.0, <=11.8.0)

directus NPM version =9.6.0, =1.6.3, =15.0.0, =1.2.2, =0.1.0, =1.0.0, =1.0.1, =1.0.0, =1.0.75 - nuxtus-server 1.0.0 Source cves: CVE-2025-53885 Source advisory: OSV:GHSA-X3VM-88HF-GPXP...

CVE-2025-53885

Directus Flows logs can disclose sensitive user data via the Log to Console operation. Affected: Directus real-time API/dashboard prior to 11.9.0 (versions 9.0.0–11.8.x). Root cause: logging unfettered input during user create/update events, enabling a malicious admin to view other users’ data. I...