影響を受けるバージョン系列
既知の脆弱性
| CVE | タイトル | 影響を受けるバージョン | CVSS | 悪用 | EPSS | 公開日 |
|---|---|---|---|---|---|---|
| CVE-2026-126539 | Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface | < 12.1.0 | 9.2 | — | 2026-11-11 | |
| CVE-2026-10716 | Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation | < 12.1.0 | 7.5 | — | 2026-08-06 | |
| CVE-2026-61836 | Directus: Authorization-dependent response served from unsegmented cache key | * | 8.6 | — | 2026-07-15 | |
| CVE-2026-61835 | Directus: SSRF Protection Bypass via 0.0.0.0 in File Import | * | 7.7 | — | 2026-07-15 | |
| CVE-2026-39943 | Directus exposes sensitive fields in revision history | * | 6.5 | — | 2026-04-10 | |
| CVE-2026-39942 | Directus has a Path Traversal and Broken Access Control in File Management API | * | 8.5 | — | 2026-04-10 | |
| CVE-2026-35442 | Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries | * | 8.1 | — | 2026-04-07 | |
| CVE-2026-35441 | Directus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limits | * | 6.5 | — | 2026-04-07 | |
| CVE-2026-35413 | Directus GraphQL Schema SDL Disclosure Setting | * | 5.3 | — | 2026-04-07 | |
| CVE-2026-35412 | Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwrite | * | 7.1 | — | 2026-04-07 | |
| CVE-2026-35411 | Directus is an Open Redirect in Admin 2FA Setup Page | * | 4.3 | — | 2026-04-07 | |
| CVE-2026-35410 | Directus has an Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow | * | 6.1 | — | 2026-04-07 | |
| CVE-2026-35409 | Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import | * | 7.7 | — | 2026-04-07 | |
| CVE-2026-35408 | Directus is Missing Cross-Origin Opener Policy | * | 8.7 | — | 2026-04-07 | |
| CVE-2026-26185 | Directus Affected by User Enumeration via Password Reset Timing Attack | * | 5.3 | — | 2026-02-13 | |
| CVE-2026-22032 | Directus has open redirect in SAML | * | 4.3 | — | 2026-01-08 | |
| CVE-2025-64749 | Directus Vulnerable to Information Leakage in Existing Collections | * | 4.3 | — | 2025-11-14 | |
| CVE-2025-64748 | Directus's conceal fields are searchable if read permissions enabled | * | 6.5 | — | 2025-11-14 | |
| CVE-2025-64747 | Directus Vulnerable to Stored Cross-site Scripting | * | 5.5 | — | 2025-11-14 | |
| CVE-2025-64746 | Directus has Improper Permission Handling on Deleted Fields | * | 4.6 | — | 2025-11-14 | |
| CVE-2025-55746 | Directus allows unauthenticated file upload and file modification due to lacking input sanitization | * | 9.3 | — | 2025-08-21 | |
| CVE-2025-53889 | Directus missing permission checks for manual trigger Flows | * | 6.5 | — | 2025-07-15 | |
| CVE-2025-53887 | Directus's exact version number is exposed by the OpenAPI Spec | * | 5.3 | — | 2025-07-15 | |
| CVE-2025-53886 | Directus doesn't redact tokens in Flow logs | * | 4.5 | — | 2025-07-15 | |
| CVE-2025-53885 | Directus doesn't redact sensitive user data when logging via event hooks | * | 4.2 | — | 2025-07-15 | |
| CVE-2025-30353 | Directus's webhook trigger flows can leak sensitive data | * | 8.6 | — | 2025-03-27 | |
| CVE-2025-30352 | Directus `search` query parameter allows enumeration of non permitted fields | * | 5.3 | — | 2025-03-27 | |
| CVE-2025-30351 | Suspended Directus user can continue to use session token to access API | * | 3.5 | — | 2025-03-27 | |
| CVE-2025-30350 | Directus's S3 assets become unavailable after a burst of HEAD requests | * | 5.3 | — | 2025-03-27 | |
| CVE-2025-30225 | Directus's S3 assets become unavailable after a burst of malformed transformations | * | 5.3 | — | 2025-03-27 | |
| CVE-2025-27089 | Overlapping policies allow update to non-allowed fields in directus | * | 5.4 | — | 2025-02-20 | |
| CVE-2025-24353 | Directus privilege escalation vulnerability using Share feature | * | 5.0 | — | 2025-01-24 | |
| CVE-2024-54151 | Directus allows unauthenticated access to WebSocket events and operations | * | 7.5 | — | 2024-12-10 | |
| CVE-2024-54128 | Directus has an HTML Injection in Comment | * | 5.7 | — | 2024-12-06 | |
| CVE-2024-47822 | Directus inserts access token from query string into logs | * | 4.2 | — | 2024-10-09 | |
| CVE-2024-46990 | SSRF Loopback IP filter bypass in directus | * | 5.0 | — | 2024-09-19 | |
| CVE-2024-45596 | Directus's session is cached for OpenID and OAuth2 if `redirect` is not used | * | 7.4 | — | 2024-09-11 | |
| CVE-2024-6534 | Directus 10.13.0 - Insecure object reference via PATH presets | = 10.13.0 | 4.3 | — | 2024-08-15 | |
| CVE-2024-6533 | Directus 10.13.0 - DOM-Based cross-site scripting (XSS) via layout_options | * | 5.4 | — | 2024-08-15 | |
| CVE-2024-39896 | Directus allows SSO User Enumeration | * | 7.5 | — | 2024-07-09 | |
| CVE-2024-39895 | Directus GraphQL Field Duplication Denial of Service (DoS) | * | 6.5 | — | 2024-07-09 | |
| CVE-2024-39701 | Directus Incorrectly handles _in` filter | * | 6.3 | — | 2024-07-09 | |
| CVE-2024-39699 | Directus has a Blind SSRF On File Import | * | 5.0 | — | 2024-07-09 | |
| CVE-2024-36128 | Directus is soft-locked by providing a string value to random string util | * | 7.5 | — | 2024-06-03 | |
| CVE-2024-34709 | Directus Lacks Session Tokens Invalidation | * | 5.4 | — | 2024-05-14 | |
| CVE-2024-34708 | Directus allows redacted data extraction on the API through "alias" | * | 4.9 | — | 2024-05-14 | |
| CVE-2024-28238 | Session Token in URL in directus | * | 2.3 | — | 2024-03-13 | |
| CVE-2024-28239 | URL Redirection to Untrusted Site in OAuth2/OpenID in directus | * | 5.4 | — | 2024-03-13 | |
| CVE-2024-27296 | Directus version number disclosure | * | 5.3 | — | 2024-03-02 | |
| CVE-2024-27295 | Directus MySQL accent insensitive email matching | * | 8.2 | — | 2024-03-02 | |
| CVE-2023-45820 | Directus crashes on invalid WebSocket message | * | 5.9 | — | 2023-10-20 | |
| CVE-2023-38503 | Directus has Incorrect Permission Checking for GraphQL Subscriptions | * | 5.7 | — | 2023-07-26 | |
| CVE-2023-28443 | directus vulnerable to Insertion of Sensitive Information into Log File | * | 4.2 | — | 2023-03-24 | |
| CVE-2023-27481 | Extract password hashes through export querying in directus | * | 4.3 | — | 2023-03-08 | |
| CVE-2023-27474 | HTML Injection in Password Reset email to custom Reset URL in directus | * | 8.0 | — | 2023-03-07 | |
| CVE-2023-26492 | Directus vulnerable to Server-Side Request Forgery On File Import | * | 5.0 | — | 2023-03-04 | |
| CVE-2022-26969 | In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. | * | 9.8 | — | 2022-12-26 | |
| CVE-2022-36031 | Unhandled exception on illegal filename_disk value | * | 6.5 | — | 2022-08-20 | |
| CVE-2022-23080 | directus - SSRF which leads to internal port scan | ≥ v9.0.0-beta.10 < unspecified ≥ unspecified ≤ v9.6.0 | — | — | 2022-06-23 | |
| CVE-2022-24814 | Cross-site Scripting in Directus | * | 8.8 | — | 2022-04-05 |
データ：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS については https://www.first.org/epss を参照）、endoflife.date。ソフトウェア一覧：awesome-selfhosted（CC BY-SA 3.0）。