CVE-2025-53887: Directus Exposes Exact Version Number via OpenAPI Spec
Summary
CVE-2025-53887: Directus' exact version number is exposed by the OpenAPI Spec. Affects directus versions < 11.9.0. Fixed in 11.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Directus is an open-source headless CMS that allows users to manage and deliver content through an API. It provides a flexible and customizable platform for developers and content creators, enabling them to build applications with ease. However, a vulnerability has been identified that exposes sensitive version information through its OpenAPI Spec endpoint.
Vulnerability Detail
The vulnerability arises from the incorrect exposure of the exact version number of Directus as the OpenAPI Spec version. This information is accessible via the '/server/specs/oas' endpoint without any authentication. An attacker can exploit this by identifying the specific version of Directus in use, allowing them to search for known vulnerabilities associated with that version or its dependencies. This could lead to potential exploitation of the system, making it a moderate risk with a CVSS score of 5.3.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.9.0
This is the first release that contains the fix.
npm install directus@11.9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the '/server/specs/oas' endpoint by implementing authentication or by blocking access via your web server configuration until the package is updated.
Conclusion
In summary, CVE-2025-53887 is a vulnerability in Directus that exposes sensitive version information through an unauthenticated endpoint. It is crucial to update to version 11.9.0 or later to mitigate this risk. Until then, implementing access restrictions can help protect your application.
See every vulnerability recorded for directus →
FAQ
CVE-2025-53887 is a vulnerability in Directus that exposes the exact version number through the OpenAPI Spec endpoint, potentially allowing attackers to exploit known vulnerabilities.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, implement authentication or restrict access to the '/server/specs/oas' endpoint as a temporary workaround.
The main risk is that attackers can identify the specific version of Directus in use, which may lead to exploitation of known vulnerabilities in that version or its dependencies.
The CVSS score for this vulnerability is 5.3, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for directus.
