CVE-2022-23080: Server-Side Request Forgery in Directus
Summary
CVE-2022-23080: Server-Side Request Forgery in Directus. Affects directus versions >= 9.0.0-beta.2, < 9.7.0. Fixed in 9.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Directus is an open-source headless CMS (Content Management System) that provides a user-friendly interface for managing content and data. It allows users to create custom database schemas, define relationships between data, and provides APIs for accessing and manipulating content. Directus versions v9.0.0-beta.2 through 9.6.0 are affected by a server-side request forgery (SSRF) vulnerability in the media upload functionality. This vulnerability enables a low privileged user to perform internal network port scans.
Vulnerability Detail
The server-side request forgery (SSRF) vulnerability in Directus allows an attacker with low privileges to manipulate the media upload functionality to perform unauthorized network port scans within the internal network. By crafting a malicious request, an attacker can force the server to make requests to arbitrary URLs, potentially leading to information disclosure or further attacks on internal systems. This vulnerability has a CVSS score of 5.0, indicating a moderate severity level.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.7.0
This is the first release that contains the fix.
npm install directus@9.7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of Directus to ensure the security of the application.
Conclusion
In conclusion, Directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to a server-side request forgery (SSRF) vulnerability in the media upload functionality. This vulnerability allows a low privileged user to perform internal network port scans, potentially leading to information disclosure or further attacks. It is crucial to upgrade to Directus version 9.7.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for directus →
FAQ
Directus is an open-source headless CMS that provides a user-friendly interface for managing content and data.
Server-side request forgery (SSRF) is a vulnerability that allows an attacker to manipulate a server into making requests to arbitrary URLs, potentially leading to information disclosure or further attacks on internal systems.
Directus versions v9.0.0-beta.2 through 9.6.0 are affected by this vulnerability.
This vulnerability allows a low privileged user to perform internal network port scans, which could lead to information disclosure or further attacks on internal systems.
To fix this vulnerability, it is recommended to upgrade to Directus version 9.7.0 or later.
Related vulnerabilities
Recent vulnerabilities recorded for directus.
