VulertSecurity VulertSecurity

Vulnerability Database · npm · directus · Version

directus 11.3.5

11.3.5 is affected by 29 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 12.5.0.

Critical 1 High 9 Medium 18 Low 1 Unrated 0

All directus versions & vulnerabilities → Source repository Search the database for this package →
Released 18 Dec 2024 Licence BUSL-1.1 Also known from other sources 29 Newer releases 300 Database updated 23/Oct/2026

Release and licence data published by the npm registry. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

directus 11.3.5 vulnerabilities

29 vulnerabilities cover directus 11.3.5. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2025-55746: Directus Unauthenticated File Upload and Modification Vulnerability 9.3 critical 11.9.3 20 Aug 2025
CVE-2026-35408: Directus Missing Cross-Origin Opener Policy Vulnerability 8.7 high 11.17.0 04 Apr 2026
CVE-2026-61836: Directus Cache Key Vulnerability Leading to Unauthorized Data Access 8.6 high 12.0.0 20 Jul 2026
CVE-2025-30353: Directus Webhook Trigger Flaw Exposes Sensitive Data 8.6 high 11.5.0 26 Mar 2025
Critical Path Traversal and Access Control Vulnerability in Directus File Management API 8.5 high 11.17.0 04 Apr 2026
CVE-2026-35442: Directus Vulnerability Allows Authenticated Users to Extract Concealed Fields via Aggregate Queries 8.1 high 11.17.0 04 Apr 2026
CVE-2026-61835: Directus SSRF Protection Bypass via 0.0.0.0 in File Import 7.7 high 12.0.0 20 Jul 2026
CVE-2026-35409: Directus SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses 7.7 high 11.16.0 04 Apr 2026
Directus Unauthenticated Denial of Service via GraphQL Alias Amplification 7.5 high 11.17.0 04 Apr 2026
CVE-2026-35412: Directus Arbitrary File Overwrite via TUS Upload Authorization Bypass 7.1 high 11.16.1 04 Apr 2026
CVE-2026-35441: Directus GraphQL Alias Amplification Denial of Service Vulnerability 6.5 medium 11.17.0 04 Apr 2026
Sensitive Data Exposure in Directus: Revision History Vulnerability 6.5 medium 11.17.0 04 Apr 2026
CVE-2025-64748: Directus Token Enumeration and Sensitive Field Exposure Vulnerability 6.5 medium 11.13.0 13 Nov 2025
CVE-2025-53889: Directus Insufficient Permission Checks Allow Unauthenticated Flow Triggers 6.5 medium 11.9.0 15 Jul 2025
CVE-2026-35410: Directus Open Redirect Vulnerability in OAuth2/SAML Authentication Flow 6.1 medium 11.16.1 04 Apr 2026
CVE-2025-64747: Directus Stored XSS Vulnerability in Block Editor 5.5 medium 11.13.0 14 Nov 2025
CVE-2026-35413: Directus GraphQL SDL Disclosure Vulnerability 5.3 medium 11.16.1 04 Apr 2026
CVE-2026-26185: Directus User Enumeration via Password Reset Timing Attack 5.3 medium 11.14.1 12 Feb 2026
CVE-2025-53887: Directus Exposes Exact Version Number via OpenAPI Spec 5.3 medium 11.9.0 15 Jul 2025
CVE-2025-30352: Directus Search Parameter Vulnerability Allows Unauthorized Field Enumeration 5.3 medium 11.5.0 26 Mar 2025
CVE-2025-64746: Directus Improper Permission Handling on Deleted Fields 4.6 medium 11.13.0 14 Nov 2025
CVE-2025-53886: Directus Exposes Session Credentials in Flow Logs 4.5 medium 11.9.0 15 Jul 2025
CVE-2026-35411: Directus Open Redirect Vulnerability in Admin 2FA Setup Page 4.3 medium 11.16.1 04 Apr 2026
CVE-2026-22032: Directus Open Redirect Vulnerability in SAML Authentication 4.3 medium 11.14.0 06 Jan 2026
CVE-2025-64749: Directus Information Leakage in Existing Collections 4.3 medium 11.13.0 13 Nov 2025
CVE-2025-53885: Directus Vulnerability Exposes Sensitive User Data in Console Logs 4.2 medium 11.9.0 15 Jul 2025
Improper Access Control in Directus 4.1 medium No fix published 15 Aug 2024
Code Injection Vulnerability in Directus 4.1 medium No fix published 15 Aug 2024
CVE-2025-30351: Directus Session Token Vulnerability Allows Suspended Users to Access API 3.5 low 11.5.0 26 Mar 2025

Looking for another version, or everything Vulert holds for directus?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About directus 11.3.5

Is directus 11.3.5 vulnerable?

Yes. 29 vulnerabilities in the Vulert database cover directus 11.3.5: 1 critical, 9 high, 18 medium and 1 low. The upgrade Vulert recommends is 12.5.0, and each entry above names the fixed version to move to.

Which version of directus should I use instead of 11.3.5?

12.5.0 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 11.3.5 the latest release of directus?

No. 11.3.5 was published 18 Dec 2024, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor directus for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the directus version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.