Skip to content

Product

directus @directus/app vulnerabilities

2 published CVES affecting directus @directus/app, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
0
Medium
2
Low
0
Unscored
0
CISA KEV
0

Latest directus @directus/app CVEs

Newest publication first

  1. CVE-2025-24353 Directus privilege escalation vulnerability using Share feature

    Published
    MediumCVSS 4.3 EPSS 0.40%

    Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.2.0, when sharing an item, a typical user can specify an arbitrary role. It allows the user to use a higher-privileged role to see fields that otherwise the user should not be abl...

  2. CVE-2024-54128 Directus has an HTML Injection in Comment

    Published
    MediumCVSS 4.6 EPSS 0.34%

    Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.