CVE-2025-30353: Directus Webhook Trigger Flaw Exposes Sensitive Data
Summary
CVE-2025-30353: Directus's webhook trigger flows can leak sensitive data. Affects directus versions >= 9.12.0, < 11.5.0. Fixed in 11.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Directus is an open-source headless CMS that provides a powerful API for managing content. It allows users to create custom data structures and manage their content through a user-friendly interface. The platform supports various triggers and flows, enabling automated responses to events. However, a vulnerability exists in the webhook trigger functionality, which can inadvertently expose sensitive data when certain conditions fail.
Vulnerability Detail
In Directus, when a Flow with the 'Webhook' trigger and the 'Data of Last Operation' response body encounters a ValidationError due to a failed condition operation, the API response may leak sensitive information. This includes environmental variables, sensitive API keys, user accountability information, and operational data. Such exposure poses a significant security risk, as it could lead to unauthorized access or misuse of sensitive information.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.5.0
This is the first release that contains the fix.
npm install directus@11.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the 'Data of Last Operation' response body in Flows that may encounter ValidationErrors. Instead, consider using a more controlled response that does not expose sensitive information.
Conclusion
The vulnerability CVE-2025-30353 in Directus poses a significant risk by potentially exposing sensitive data through webhook triggers. It is crucial to update to the latest version to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for directus →
FAQ
CVE-2025-30353 is a vulnerability in Directus that allows sensitive data to be exposed through webhook triggers when certain conditions fail.
If your Directus installation uses webhook triggers with the 'Data of Last Operation' response, it may expose sensitive information, including environmental variables and user details, in the event of a ValidationError.
If an immediate update is not possible, avoid using the vulnerable response body in your Flows as a temporary workaround to minimize the risk of data exposure.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 8.6, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for directus.
