Skip to content
Threat Feed
Subscribe

Tag

Directus

3 briefs RSS
critical advisory

Directus Aggregate Query Vulnerability Allows Disclosure of Concealed Data

A vulnerability in Directus versions prior to 11.17.0 allows authenticated users to extract concealed field values, including static API tokens and two-factor authentication secrets from directus_users, via aggregate queries.

directus vulnerability credential-access api-token 2fa-bypass
2r 1t
high advisory

Directus SSRF Vulnerability via IPv4-Mapped IPv6 Addresses

Directus versions before 11.16.0 are vulnerable to Server-Side Request Forgery (SSRF) due to a bypass in IP address validation using IPv4-Mapped IPv6 addresses, allowing attackers to access internal services and sensitive cloud metadata.

Directus <= 12.0.0 ssrf directus vulnerability
2r 1t 3i updated
high advisory

Directus File Overwrite Vulnerability (CVE-2026-39942)

A file overwrite vulnerability (CVE-2026-39942) exists in Directus versions prior to 11.17.0, where an attacker can overwrite another user's files by manipulating the filename_disk parameter in the PATCH /files/{id} endpoint, potentially leading to data corruption or privilege escalation.

Directus file-overwrite privilege-escalation CVE-2026-39942
2r 2t 1c