Vulnerability · Published Jul 14, 2025 · Assigned by GitHub_M
CVE-2025-53887Directus's exact version number is exposed by the OpenAPI Spec
Medium 5.3
In plain English
A medium-severity information exposure in directus from directus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, the exact Directus version number is incorrectly being used as OpenAPI Spec version this means that it is being exposed by the `/server/specs/oas` endpoint without authentication. With the exact version information a malicious attacker can look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version. Version 11.9.0 fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | directus | 11.9.0 | GHSA-rmjh-cf9q-pv7q |
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/directus/directus/security/advisories/GHSA-rmjh-cf9q-pv7q x_refsource_CONFIRM
- https://github.com/directus/directus/pull/25353 x_refsource_MISC
- https://github.com/directus/directus/commit/e74f3e4e92edc33b5f83eefb001a3d2a85af17a3 x_refsource_MISC
- https://github.com/directus/directus/releases/tag/v11.9.0 x_refsource_MISC