VulertSecurity VulertSecurity

Vulnerability Database · npm · directus · Version

directus 10.6.4

10.6.4 is affected by 39 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 12.5.0.

Critical 0 High 13 Medium 24 Low 2 Unrated 0

All directus versions & vulnerabilities → Source repository Search the database for this package →
Released 20 Oct 2023 Licence BUSL-1.1 Also known from other sources 39 Newer releases 300 Database updated 23/Oct/2026

Release and licence data published by the npm registry. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

directus 10.6.4 vulnerabilities

39 vulnerabilities cover directus 10.6.4. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2026-35408: Directus Missing Cross-Origin Opener Policy Vulnerability 8.7 high 11.17.0 04 Apr 2026
CVE-2026-61836: Directus Cache Key Vulnerability Leading to Unauthorized Data Access 8.6 high 12.0.0 20 Jul 2026
CVE-2025-30353: Directus Webhook Trigger Flaw Exposes Sensitive Data 8.6 high 11.5.0 26 Mar 2025
Critical Path Traversal and Access Control Vulnerability in Directus File Management API 8.5 high 11.17.0 04 Apr 2026
CVE-2024-27295: Directus MySQL Accent Insensitive Email Matching 8.2 high 10.8.3 01 Mar 2024
CVE-2026-35442: Directus Vulnerability Allows Authenticated Users to Extract Concealed Fields via Aggregate Queries 8.1 high 11.17.0 04 Apr 2026
CVE-2026-61835: Directus SSRF Protection Bypass via 0.0.0.0 in File Import 7.7 high 12.0.0 20 Jul 2026
CVE-2026-35409: Directus SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses 7.7 high 11.16.0 04 Apr 2026
Directus Unauthenticated Denial of Service via GraphQL Alias Amplification 7.5 high 11.17.0 04 Apr 2026
CVE-2024-39896: Directus Allows Single Sign-On User Enumeration 7.5 high 10.13.0 08 Jul 2024
CVE-2024-36128: Directus npm Package Denial of Service Vulnerability 7.5 high 10.11.2 04 Jun 2024
CVE-2024-45596: OpenID and OAuth2 Session Caching Vulnerability in Directus 7.4 high 10.13.3 10 Sep 2024
CVE-2026-35412: Directus Arbitrary File Overwrite via TUS Upload Authorization Bypass 7.1 high 11.16.1 04 Apr 2026
CVE-2026-35441: Directus GraphQL Alias Amplification Denial of Service Vulnerability 6.5 medium 11.17.0 04 Apr 2026
Sensitive Data Exposure in Directus: Revision History Vulnerability 6.5 medium 11.17.0 04 Apr 2026
CVE-2025-64748: Directus Token Enumeration and Sensitive Field Exposure Vulnerability 6.5 medium 11.13.0 13 Nov 2025
CVE-2025-53889: Directus Insufficient Permission Checks Allow Unauthenticated Flow Triggers 6.5 medium 11.9.0 15 Jul 2025
CVE-2026-35410: Directus Open Redirect Vulnerability in OAuth2/SAML Authentication Flow 6.1 medium 11.16.1 04 Apr 2026
CVE-2025-64747: Directus Stored XSS Vulnerability in Block Editor 5.5 medium 11.13.0 14 Nov 2025
CVE-2024-28239: Open Redirect Vulnerability in directus 5.4 medium 10.10.0 12 Mar 2024
CVE-2026-35413: Directus GraphQL SDL Disclosure Vulnerability 5.3 medium 11.16.1 04 Apr 2026
CVE-2026-26185: Directus User Enumeration via Password Reset Timing Attack 5.3 medium 11.14.1 12 Feb 2026
CVE-2025-53887: Directus Exposes Exact Version Number via OpenAPI Spec 5.3 medium 11.9.0 15 Jul 2025
CVE-2025-30352: Directus Search Parameter Vulnerability Allows Unauthorized Field Enumeration 5.3 medium 11.5.0 26 Mar 2025
CVE-2024-27296: Directus version number disclosure 5.3 medium 10.8.3 01 Mar 2024
CVE-2025-24353: Directus Privilege Escalation via Share Feature 5.0 medium 11.2.0 23 Jan 2025
CVE-2024-46990: Directus SSRF Loopback IP Filter Bypass Vulnerability 5.0 medium 10.13.3 18 Sep 2024
Directus Package - Redacted Data Extraction Vulnerability 4.9 medium 10.11.0 13 May 2024
CVE-2025-64746: Directus Improper Permission Handling on Deleted Fields 4.6 medium 11.13.0 14 Nov 2025
CVE-2025-53886: Directus Exposes Session Credentials in Flow Logs 4.5 medium 11.9.0 15 Jul 2025
CVE-2026-35411: Directus Open Redirect Vulnerability in Admin 2FA Setup Page 4.3 medium 11.16.1 04 Apr 2026
CVE-2026-22032: Directus Open Redirect Vulnerability in SAML Authentication 4.3 medium 11.14.0 06 Jan 2026
CVE-2025-64749: Directus Information Leakage in Existing Collections 4.3 medium 11.13.0 13 Nov 2025
CVE-2025-53885: Directus Vulnerability Exposes Sensitive User Data in Console Logs 4.2 medium 11.9.0 15 Jul 2025
Insecure Object Reference in Directus 4.1 medium 10.13.2 27 Aug 2024
Improper Access Control in Directus 4.1 medium No fix published 15 Aug 2024
Code Injection Vulnerability in Directus 4.1 medium No fix published 15 Aug 2024
DOM-Based XSS Vulnerability in Directus: Account Takeover Risk 3.4 low 11.3.3 23 Jan 2025
CVE-2024-28238: Session Token in URL in directus 2.3 low 10.10.0 12 Mar 2024

Looking for another version, or everything Vulert holds for directus?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About directus 10.6.4

Is directus 10.6.4 vulnerable?

Yes. 39 vulnerabilities in the Vulert database cover directus 10.6.4: 0 critical, 13 high, 24 medium and 2 low. The upgrade Vulert recommends is 12.5.0, and each entry above names the fixed version to move to.

Which version of directus should I use instead of 10.6.4?

12.5.0 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 10.6.4 the latest release of directus?

No. 10.6.4 was published 20 Oct 2023, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor directus for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the directus version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.