GitHub Advisoryadvisory · npm

GHSA-rmjh-cf9q-pv7q Directus' exact version number is exposed by the OpenAPI Spec

MEDIUM Published 2025-07-15 Modified 2025-07-15 Official page ↗
Aliases
CVE-2025-53887
Ecosystem
npm
Packages
directus
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2025-07-15

Affected packages

• npm directus: < 11.9.0 → fixed in 11.9.0

Description

Summary The exact Directus version number is incorrectly being used as OpenAPI Spec version this means that it is being exposed by the `/server/specs/oas` endpoint without authentication. Impact With the exact version information a malicious attacker can look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version.

Related

Alias · CVE (1)

  • CVE-2025-53887 Directus is a real-time API and App dashboard for managing SQL database content. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References