Vulnerability · Published Aug 5, 2026 · Assigned by Fluid Attacks

CVE-2026-10716Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation

High 7.5

In plain English

A high-severity SQL injection in Directus from Directus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 4.0)7.5High

Exploit odds (30 days)0.4%top 63.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields[].type value starts with geometry but contains attacker-controlled SQL syntax after the geometry subtype.This issue affects Directus: before 12.1.0.

Affected products (as reported)

Vendor	Product	Versions
Directus	Directus	0 – before 12.1.0

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://fluidattacks.com/es/advisories/metallica third-party-advisory
https://github.com/directus/directus product
https://github.com/directus/directus/security/advisories/GHSA-chfm-g7r3-vv42 vendor-advisory
https://github.com/directus/directus/releases#release-v12.1.0 patch