SQL injection in Directus - CVE-2026-10716
Published: August 7, 2026
Vulnerability identifier: #VU141279
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-10716
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary SQL.
The vulnerability exists due to SQL injection in the PostgreSQL geometry helper during collection creation when processing a crafted geometry field subtype in collection field definitions. A remote privileged user can supply a specially crafted geometry subtype string to execute arbitrary SQL.
Exploitation is possible only when Directus uses a PostgreSQL backend with the PostGIS extension enabled, and the injected SQL runs with the privileges of the configured database role. It is exploitable as a blind, time-based injection, which can enable conditional data extraction through timing.
Affected software
Directus
How to mitigate CVE-2026-10716
Install security update from vendor's website.
Directus - update to 12.1.0