SB2026080776 - Multiple vulnerabilities in Directus

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080776

SB2026080776 - Multiple vulnerabilities in Directus

Published: August 7, 2026

Security Bulletin ID SB2026080776
CSH Severity
High
Patch available
YES
Number of vulnerabilities 14
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 14% Medium 43% Low 43%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 14 vulnerabilities.


1) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to read, create, update, or delete records in any user-defined collection.

The vulnerability exists due to missing authorization in the WebSocket REST items handler and ItemsService when processing subsequent items messages on a socket after a failed auth message or token expiry clears accountability to null. A remote attacker can send an invalid authentication message and then send crafted items messages to read, create, update, or delete records in any user-defined collection.

Only instances with WebSocket REST access enabled in public authentication mode are affected. Directus system collections are not reachable through this path.


2) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary script in a victim\'s browser session.

The vulnerability exists due to cross-site scripting in generateFavicon (`app/src/utils/generate-favicon.ts`) when building the fallback favicon from the configured project color. A remote user can store a crafted project color value to execute arbitrary script in a victim\'s browser session.

User interaction is required to load the Directus application URL, and the payload can trigger for visitors including unauthenticated users on the login page.


3) SQL injection (CVE-ID: CVE-2026-10716)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary SQL.

The vulnerability exists due to SQL injection in the PostgreSQL geometry helper during collection creation when processing a crafted geometry field subtype in collection field definitions. A remote privileged user can supply a specially crafted geometry subtype string to execute arbitrary SQL.

Exploitation is possible only when Directus uses a PostgreSQL backend with the PostGIS extension enabled, and the injected SQL runs with the privileges of the configured database role. It is exploitable as a blind, time-based injection, which can enable conditional data extraction through timing.


4) Missing Origin Validation in WebSockets (CVE-ID: N/A)

CWE-ID: CWE-1385 - Missing Origin Validation in WebSockets

CVSSv4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information and perform unauthorized actions via an authenticated WebSocket session.

The vulnerability exists due to missing origin validation in WebSocket upgrade handler when processing cross-origin WebSocket upgrade requests that include a session cookie. A remote attacker can trick the victim into visiting an attacker-controlled page to disclose sensitive information and perform unauthorized actions via an authenticated WebSocket session.

User interaction is required, and exploitation is possible only when WebSockets are enabled and the victim\'s browser sends the session cookie with the cross-origin handshake.


5) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to overwrite arbitrary storage paths and existing stored file content.

The vulnerability exists due to path traversal in the TUS upload implementation when processing the filename_disk value supplied in the Upload-Metadata header. A remote user can send a specially crafted TUS upload request to overwrite arbitrary storage paths and existing stored file content.

Exploitation requires TUS uploads to be enabled and create permission on directus_files. On object storage drivers, relative traversal segments can escape the configured root prefix, and configuration-dependent server-side code execution may be possible if executed directories are placed inside the same storage location.


6) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in resolvers/system-global.ts when processing aliased GraphQL calls to anonymously reachable system resolvers through POST /graphql/system. A remote attacker can send a specially crafted GraphQL request with many aliased resolver invocations to cause a denial of service.

The issue affects the auth_login, auth_password_request, utils_hash_generate, and utils_hash_verify resolvers, and HTTP-level rate limiting counts requests rather than resolver invocations.


7) Incorrect behavior order (CVE-ID: N/A)

CWE-ID: CWE-696 - Incorrect Behavior Order

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause unauthorized telemetry submission and modify a settings field.

The vulnerability exists due to incorrect behavior order in the POST /settings/owner endpoint when handling unauthenticated requests before authorization completes. A remote attacker can send a specially crafted request to cause unauthorized telemetry submission and modify a settings field.

Only instances with PROJECT_OWNER_ENABLED enabled are vulnerable. If the outbound compliance report fails, the issue can set directus_settings.project_status to pending, which can later trigger additional owner reports.


8) Incorrect behavior order (CVE-ID: N/A)

CWE-ID: CWE-696 - Incorrect Behavior Order

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to incorrect behavior order in FlowsService.deleteMany when handling a DELETE request for a flow. A remote attacker can send a specially crafted request referencing a known flow UUID to cause a denial of service.

Webhook-trigger flow UUIDs may be exposed in public trigger URLs, and affected flows can appear active while downstream steps no longer run.


9) Incorrect behavior order (CVE-ID: N/A)

CWE-ID: CWE-696 - Incorrect Behavior Order

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to modify attribution metadata.

The vulnerability exists due to incorrect behavior order in UsersService.deleteMany when handling a delete request for a user. A remote attacker can send a specially crafted request targeting a user they cannot delete to modify attribution metadata.

The issue can nullify authorship and sender fields in comments, notifications, and content version records.


10) Incorrect behavior order (CVE-ID: N/A)

CWE-ID: CWE-696 - Incorrect Behavior Order

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to incorrect behavior order in SharesService.updateMany and SharesService.deleteMany when handling share update or delete requests. A remote attacker can send a specially crafted request using any path-valid UUID to cause a denial of service.

The target UUID does not need to correspond to an existing row, and the issue forces permission data to be re-derived from the database by invalidating the global permissions cache.


11) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to overwrite another user\'s file and rewrite its metadata.

The vulnerability exists due to authorization bypass through user-controlled key in the TUS resumable upload endpoint when processing upload replacement metadata. A remote user can supply a victim file id in the Upload-Metadata header to overwrite another user\'s file and rewrite its metadata.

Only instances with `TUS_ENABLED=true` are vulnerable. The issue affects upload replacement through the `replace_id` metadata key, and no victim interaction is required.


12) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the GraphQL WebSocket endpoint when processing GraphQL query and mutation documents over WebSocket transport. A remote user can send a deeply nested crafted GraphQL document to cause a denial of service.

Only instances with WebSockets enabled, GraphQL over WebSockets enabled, and a reachable WebSocket GraphQL endpoint are vulnerable. Amplification depends on user-defined collections with cyclic or self-referencing relations.


13) Asymmetric Resource Consumption (Amplification) (CVE-ID: N/A)

CWE-ID: CWE-405 - Asymmetric Resource Consumption (Amplification)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the /utils/hash/verify endpoint and its GraphQL and SDK equivalents when processing caller-supplied Argon2 hashes with attacker-controlled cost parameters. A remote attacker can send a specially crafted request to cause a denial of service.

The affected functionality is reachable without authentication, and exploitation can degrade or make authentication flows unavailable.


14) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive files from the host filesystem.

The vulnerability exists due to path traversal in the Mail Service template engine when resolving user-supplied email template names. A remote privileged user can supply a crafted relative template path to disclose sensitive files from the host filesystem.

Exploitation requires the ability to configure a Flow \"Send Email\" operation and relies on the presence of a file at a traversed path that the Liquid engine will load and render.


Remediation

Install update from vendor's website.

References