VulertSecurity VulertSecurity

Vulnerability Database · npm · directus · Version

directus 11.15.4

11.15.4 is affected by 15 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 12.5.0.

Critical 0 High 8 Medium 7 Low 0 Unrated 0

All directus versions & vulnerabilities → Source repository Search the database for this package →
Released 17 Feb 2026 Licence BUSL-1.1 Also known from other sources 13 Newer releases 300 Database updated 23/Oct/2026

Release and licence data published by the npm registry. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

directus 11.15.4 vulnerabilities

15 vulnerabilities cover directus 11.15.4. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2026-35408: Directus Missing Cross-Origin Opener Policy Vulnerability 8.7 high 11.17.0 04 Apr 2026
CVE-2026-61836: Directus Cache Key Vulnerability Leading to Unauthorized Data Access 8.6 high 12.0.0 20 Jul 2026
Critical Path Traversal and Access Control Vulnerability in Directus File Management API 8.5 high 11.17.0 04 Apr 2026
CVE-2026-35442: Directus Vulnerability Allows Authenticated Users to Extract Concealed Fields via Aggregate Queries 8.1 high 11.17.0 04 Apr 2026
CVE-2026-61835: Directus SSRF Protection Bypass via 0.0.0.0 in File Import 7.7 high 12.0.0 20 Jul 2026
CVE-2026-35409: Directus SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses 7.7 high 11.16.0 04 Apr 2026
Directus Unauthenticated Denial of Service via GraphQL Alias Amplification 7.5 high 11.17.0 04 Apr 2026
CVE-2026-35412: Directus Arbitrary File Overwrite via TUS Upload Authorization Bypass 7.1 high 11.16.1 04 Apr 2026
CVE-2026-35441: Directus GraphQL Alias Amplification Denial of Service Vulnerability 6.5 medium 11.17.0 04 Apr 2026
Sensitive Data Exposure in Directus: Revision History Vulnerability 6.5 medium 11.17.0 04 Apr 2026
CVE-2026-35410: Directus Open Redirect Vulnerability in OAuth2/SAML Authentication Flow 6.1 medium 11.16.1 04 Apr 2026
CVE-2026-35413: Directus GraphQL SDL Disclosure Vulnerability 5.3 medium 11.16.1 04 Apr 2026
CVE-2026-35411: Directus Open Redirect Vulnerability in Admin 2FA Setup Page 4.3 medium 11.16.1 04 Apr 2026
Improper Access Control in Directus 4.1 medium No fix published 15 Aug 2024
Code Injection Vulnerability in Directus 4.1 medium No fix published 15 Aug 2024

Looking for another version, or everything Vulert holds for directus?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About directus 11.15.4

Is directus 11.15.4 vulnerable?

Yes. 15 vulnerabilities in the Vulert database cover directus 11.15.4: 0 critical, 8 high, 7 medium and 0 low. The upgrade Vulert recommends is 12.5.0, and each entry above names the fixed version to move to.

Which version of directus should I use instead of 11.15.4?

12.5.0 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 11.15.4 the latest release of directus?

No. 11.15.4 was published 17 Feb 2026, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor directus for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the directus version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.