CVE-2025-53885: Directus Vulnerability Exposes Sensitive User Data in Console Logs
Summary
CVE-2025-53885: Directus is vulnerable to sensitive data exposure as user data is not being redacted when logged. Affects directus versions >= 9.0.0, < 11.9.0. Fixed in 11.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Directus is an open-source headless CMS that allows users to manage content and data through an intuitive interface. It provides a flexible API for developers and supports various data types and relationships. However, a vulnerability exists in its Flows feature, which can lead to sensitive user data exposure if not handled properly.
Vulnerability Detail
The vulnerability arises from the 'Log to Console' operation in Directus Flows, where incoming user data can be logged without redaction. This allows malicious administrators to access sensitive information from other users during CRUD operations, potentially leading to data breaches and privacy violations. The issue is particularly concerning as it can occur during user creation or updates, exposing personal data that should remain confidential.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.9.0
This is the first release that contains the fix.
npm install directus@11.9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid logging sensitive data to the console outside of development contexts. Ensure that any logging operations are thoroughly reviewed to prevent exposure of user information.
Conclusion
The CVE-2025-53885 vulnerability in Directus poses a significant risk by allowing sensitive user data to be logged without redaction. It is crucial for users of Directus to update to the patched version or implement workarounds to safeguard against potential data breaches.
See every vulnerability recorded for directus →
FAQ
CVE-2025-53885 is a vulnerability in Directus that allows sensitive user data to be logged to the console, potentially exposing it to malicious administrators.
If your application uses Directus and allows admins to log user data, this vulnerability can lead to unauthorized access to sensitive information, risking user privacy.
If an immediate update is not possible, avoid logging sensitive data to the console and review your logging practices to minimize exposure.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 4.2, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for directus.
