SB2026082161 - Multiple vulnerabilities in Directus

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026082161

SB2026082161 - Multiple vulnerabilities in Directus

Published: August 21, 2026

Security Bulletin ID SB2026082161
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 60% Low 40%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Prototype pollution (CVE-ID: N/A)

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a persistent denial of service.

The vulnerability exists due to improperly controlled modification of object prototype attributes in the global query-sanitization middleware handling the `deep` query parameter when parsing a user-supplied JSON string. A remote attacker can send a specially crafted GET request to cause a persistent denial of service.

The vulnerable code path is reached before any per-collection permission check, and supplying `deep` as an opaque JSON string bypasses the underlying query parser\'s stripping of prototype-named bracket keys.


2) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information from internal-only destinations.

The vulnerability exists due to server-side request forgery in the AI chat file download handling in POST /ai/chat when processing user-supplied file URLs. A remote user can send a specially crafted chat request containing a file URL that resolves to an internal address to disclose sensitive information from internal-only destinations.

The fetched response body is forwarded to the configured LLM provider as file content and may surface in the model reply. Only instances with AI enabled and a configured LLM provider are vulnerable.


3) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the image-transform endpoint in AssetsService.getAsset when processing user-supplied width and height parameters on GET /assets/<id>. A remote attacker can send a specially crafted request to cause a denial of service.

HEAD requests trigger the full transform while transferring no response body.


4) Improper Authentication (CVE-ID: N/A)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute manual trigger flows intended only for authenticated users.

The vulnerability exists due to improper authentication in the manual trigger handler and public trigger endpoint when handling unauthenticated requests to POST /flows/trigger/:id. A remote attacker can send a crafted request to execute manual trigger flows intended only for authenticated users.

Exploitation requires an active manual Flow, the Flow to be enabled for a collection readable by the Public role, knowledge of the Flow ID, and, if item selection is required, knowledge of a readable item ID.


5) Insufficient Granularity of Access Control (CVE-ID: N/A)

CWE-ID: CWE-1220 - Insufficient Granularity of Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the directus_settings singleton when handling REST and GraphQL system endpoint requests. A remote user can read unrestricted settings fields to disclose sensitive information.

Exploitation requires a valid non-admin account with app access enabled. Plaintext authorization headers stored in ai_openai_compatible_headers may be exposed along with backend URLs and AI or MCP prompt content.


Remediation

Install update from vendor's website.

References