CVE-2026-35409: Directus SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses
Summary
CVE-2026-35409: Directus: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import. Affects directus versions < 11.16.0. Fixed in 11.16.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Directus is an open-source headless CMS that provides a powerful API for managing content. It is designed for developers and offers features like file management, user authentication, and customizable data models. However, it has a vulnerability that allows attackers to bypass server-side request forgery (SSRF) protections, potentially exposing internal services.
Vulnerability Detail
A Server-Side Request Forgery (SSRF) protection bypass has been discovered in Directus due to improper validation of IPv4-Mapped IPv6 addresses. The IP address validation mechanism intended to block requests to local and private networks failed to normalize these addresses before checking them against a deny-list. This oversight allows attackers to exploit the vulnerability, enabling them to send requests to internal services or cloud metadata endpoints, which could lead to unauthorized access to sensitive data.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.16.0
This is the first release that contains the fix.
npm install directus@11.16.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, consider restricting access to the Directus application from untrusted networks or implementing additional firewall rules to block unauthorized access to internal services.
Conclusion
The SSRF protection bypass vulnerability in Directus (CVE-2026-35409) poses significant risks to users by allowing unauthorized access to internal services. It is crucial to update to version 11.16.0 or later to mitigate these risks effectively. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for directus →
FAQ
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources, potentially leading to data exposure or unauthorized actions.
Any user of Directus versions prior to 11.16.0 may be affected, especially if they have enabled public file-import permissions.
An attacker could exploit this vulnerability to access internal services, databases, or cloud instance metadata, leading to data breaches or further exploitation of the server.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By simply uploading your package-lock.json file, you can check for vulnerabilities without needing to install any software.
The CVSS score for this vulnerability is 7.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for directus.
