CVE-2026-61835: Directus SSRF Protection Bypass via 0.0.0.0 in File Import
Summary
CVE-2026-61835: Directus: SSRF Protection Bypass via 0.0.0.0 in File Import. Affects directus versions < 12.0.0. Fixed in 12.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Directus is an open-source headless CMS that provides a powerful API for managing content. It allows users to import files from URLs, enabling seamless integration with various data sources. However, this functionality can expose the system to security risks if not properly secured, particularly through Server-Side Request Forgery (SSRF) vulnerabilities.
Vulnerability Detail
The SSRF protection in Directus's file-import-from-URL feature can be bypassed using the address '0.0.0.0'. While other internal addresses like '127.0.0.1' are blocked, '0.0.0.0' is not included in the deny-list. This oversight allows authenticated users with file-upload rights to make the server fetch internal services, leading to full-read SSRF vulnerabilities. The issue arises from how the deny-list is processed, where '0.0.0.0' is treated as a special keyword but not blocked as a literal address. This allows requests to 'http://0.0.0.0:8055/' to pass the blocklist check, effectively reaching localhost and exposing sensitive internal services.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
12.0.0
This is the first release that contains the fix.
npm install directus@12.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually modify the deny-list configuration in Directus to include '0.0.0.0'. This can be done by updating the 'IMPORT_IP_DENY_LIST' setting in your configuration file to: ['0.0.0.0', '127.0.0.1', '169.254.169.254']. However, this is not a permanent solution and upgrading to the patched version is strongly recommended.
Conclusion
The SSRF protection bypass vulnerability in Directus allows authenticated users to exploit the file-import-from-URL feature using the address '0.0.0.0'. It is crucial to update to version 12.0.0 or later to mitigate this risk. Additionally, users can implement temporary workarounds while preparing for the upgrade.
See every vulnerability recorded for directus →
FAQ
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to make requests from the server to internal or external resources, potentially exposing sensitive data.
Authenticated users with file-upload rights in Directus versions 12.0.0 and earlier are affected by this vulnerability.
An attacker could exploit this vulnerability to access internal services, databases, or APIs that are bound to localhost, leading to data exposure.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for directus.
