Directus is Vulnerable to Stored Cross-site Scripting

Summary A stored cross-site scripting XSS vulnerability exists that allows users with upload files and edit item permissions to inject malicious JavaScript through the Block Editor interface. Attackers can bypass Content Security Policy CSP restrictions by combining file uploads with iframe srcdo...

@bicou/directus-extension-imagga (>=1.6.3, <=1.6.6), @directus/api (>=20.0.0-rc.0, <=31.0.0) +1 more potentially affected by CVE-2025-64747 via directus (>=11.0.0, <=11.12.0)

directus NPM version =11.0.0, =1.6.3, =20.0.0-rc.0, =31.0.0 - @fahami/directus-pkce 1.0.0 Source cves: CVE-2025-64747 Source advisory: OSV:GHSA-VV2V-PW69-8CRF...

GHSA-VV2V-PW69-8CRF Directus is Vulnerable to Stored Cross-site Scripting

Summary A stored cross-site scripting XSS vulnerability exists that allows users with upload files and edit item permissions to inject malicious JavaScript through the Block Editor interface. Attackers can bypass Content Security Policy CSP restrictions by combining file uploads with iframe srcdo...

@bicou/directus-extension-imagga (>=1.6.3, <=1.6.6), @directus/api (>=20.0.0-rc.0, <=31.0.0) +1 more potentially affected by CVE-2025-64746 via directus (>=11.0.0, <=11.12.0)

directus NPM version =11.0.0, =1.6.3, =20.0.0-rc.0, =31.0.0 - @fahami/directus-pkce 1.0.0 Source cves: CVE-2025-64746 Source advisory: OSV:GHSA-9X5G-62GJ-WQF2...

EUVD-2025-175379

Directus has Improper Permission Handling on Deleted Fields...

GHSA-9X5G-62GJ-WQF2 Directus has Improper Permission Handling on Deleted Fields

Summary Directus does not properly clean up field-level permissions when a field is deleted. If a new field with the same name is created later, the system automatically re-applies the old permissions, which can lead to unauthorized access. Details When a field is removed from a collection, its...

PT-2025-46943

🟠 Directus, Information Disclosure Vulnerability, CVE-2024-28819 Medium https://t.co/UpL6xmyais...

PT-2025-46944

🔴 Directus, Authentication Bypass, CVE-2024-57702 Critical https://t.co/9yo2kbBDPq...

@bicou/directus-extension-imagga (>=1.6.3, <=1.6.6), @directus/api (>=20.0.0-rc.0, <=31.0.0) +1 more potentially affected by CVE-2025-64749 via directus (>=11.0.0, <=11.12.0)

directus NPM version =11.0.0, =1.6.3, =20.0.0-rc.0, =31.0.0 - @fahami/directus-pkce 1.0.0 Source cves: CVE-2025-64749 Source advisory: OSV:GHSA-CPH6-524F-3HGR...

EUVD-2025-177199

Directus Vulnerable to Information Leakage in Existing Collections...

GHSA-CPH6-524F-3HGR Directus Vulnerable to Information Leakage in Existing Collections

Summary: An observable difference in error messaging was found in the Directus REST API. The /items/collection API returns different error messages for these two cases: 1. A user tries to access an existing collection which they are not authorized to access. 2. A user tries to access a non-existi...

EUVD-2025-177193

Directus's conceal fields are searchable if read permissions enabled...

GHSA-8JPW-GPR4-8CMH Directus's conceal fields are searchable if read permissions enabled

Summary A vulnerability allows authenticated users to search concealed/sensitive fields when they have read permissions. While actual values remain masked , successful matches can be detected through returned records, enabling enumeration attacks on sensitive data. Details The system permits sear...

Insertion of Sensitive Information Into Sent Data

Overview @directus/api is a real-time API and App dashboard for managing SQL database content Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data due to concealed fields being searchable if read permissions enabled. An attacker can infer the...

@bicou/directus-extension-imagga (>=1.6.3, <=1.6.6), @directus/api (>=20.0.0-rc.0, <=31.0.0) +1 more potentially affected by CVE-2025-64748 via directus (>=11.0.0, <=11.12.0)

directus NPM version =11.0.0, =1.6.3, =20.0.0-rc.0, =31.0.0 - @fahami/directus-pkce 1.0.0 Source cves: CVE-2025-64748 Source advisory: OSV:GHSA-8JPW-GPR4-8CMH...

CVE-2025-64748

Directus is a real-time API and App dashboard for managing SQL database content. A vulnerability in versions prior to 11.13.0 allows authenticated users to search concealed/sensitive fields when they have read permissions. While actual values remain masked , successful matches can be detected...

CVE-2025-64747

Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting XSS vulnerability exists in versions prior to 11.13.0 that allows users with upload files and edit item permissions to inject malicious JavaScript through the Block Editor interface...

CVE-2025-64749

Directus is a real-time API and App dashboard for managing SQL database content. An observable difference in error messaging was found in the Directus REST API in versions of Directus prior to version 11.13.0. The /items/collection API returns different error messages for two cases: when a user...

@directus/api (31.0.0), directus (11.12.0) potentially affected by CVE-2025-64747 via @directus/app (14.0.0)

@directus/app NPM version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @directus/app and may be impacted: - @directus/api 31.0.0 - directus 11.12.0 Source cves: CVE-2025-64747 Source advisory: SNYK:JS-DIRECTUSAPP-13985180...

Cross-site Scripting (XSS)

Overview @directus/app is an App dashboard for Directus Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Block Editor interface when users with upload files and edit item permissions inject malicious JavaScript. An attacker can execute arbitrary scripts in the...