Product by Directus
Directus
56 known vulnerabilities in Directus (Directus), 0 of them actively exploited (CISA KEV).
Key figures
56
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-55746 | Directus allows unauthenticated file upload and file modification due to lacking input sanitization | 9.3 | |
| Critical | CVE-2022-26969 | Monospace Directus: security vulnerability | 9.8 | |
| High | CVE-2026-61836 | Directus: Authorization-dependent response served from unsegmented cache key | 8.6 | |
| High | CVE-2026-61835 | Directus: SSRF Protection Bypass via 0.0.0.0 in File Import | 7.7 | |
| Medium | CVE-2020-19850 | Monospace Directus: Denial of Service | 6.5 | |
| Medium | CVE-2025-53887 | Directus's exact version number is exposed by the OpenAPI Spec | 5.3 | |
| High | CVE-2024-27295 | Directus MySQL accent insensitive email matching | 8.2 | |
| High | CVE-2025-30353 | Directus's webhook trigger flows can leak sensitive data | 8.6 | |
| High | CVE-2024-54151 | Directus allows unauthenticated access to WebSocket events and operations | 7.5 | |
| Medium | CVE-2022-36031 | Unhandled exception on illegal filename_disk value | 6.5 | |
| High | CVE-2024-45596 | Directus's session is cached for OpenID and OAuth2 if `redirect` is not used | 7.4 | |
| Medium | CVE-2024-39895 | Directus GraphQL Field Duplication Denial of Service (DoS) | 6.5 | |
| High | CVE-2024-36128 | Directus is soft-locked by providing a string value to random string util | 7.5 | |
| High | CVE-2026-35442 | Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries | 8.1 | |
| High | CVE-2026-35409 | Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import | 7.7 | |
| Medium | CVE-2023-45820 | Directus crashes on invalid WebSocket message | 5.9 | |
| Critical | CVE-2026-35408 | Directus is Missing Cross-Origin Opener Policy | 8.7 | |
| High | CVE-2026-39942 | Directus has a Path Traversal and Broken Access Control in File Management API | 8.5 | |
| High | CVE-2024-39896 | Directus allows SSO User Enumeration | 7.5 | |
| High | CVE-2023-26492 | Directus vulnerable to Server-Side Request Forgery On File Import | 5.0 | |
| High | CVE-2026-35412 | Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwrite | 7.1 | |
| Medium | CVE-2026-35441 | Directus: Allocation of Resources Without Limits or Throttling | 6.5 | |
| Medium | CVE-2025-53889 | Directus missing permission checks for manual trigger Flows | 6.5 | |
| Medium | CVE-2024-34708 | Directus allows redacted data extraction on the API through "alias" | 4.9 | |
| Medium | CVE-2024-28239 | URL Redirection to Untrusted Site in OAuth2/OpenID in directus | 5.4 |