CVE-2026-35409highCWE-918

CVE-2026-35409: falha de alta gravidade em directus

Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar directus+ Monitorar directus

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.7epss 0.3%
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.0, a Server-Side Request Forgery (SSRF) protection bypass has been identified and fixed in Directus. The IP address validation mechanism used to block requests to local and private networks could be circumvented using IPv4-Mapped IPv6 address notation. This vulnerability is fixed in 11.16.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Produtos afetados
directus · directus
CVEs relacionadas — directus

No mesmo produto, das mais perigosas para as menos.

CVE-2025-55746CRITICALDirectus allows unauthenticated file upload and file modification due to lacking input sanitizationEPSS 1.4%CVE-2022-24814HIGHCross-site Scripting in DirectusEPSS 1.0%CVE-2025-53887MEDIUMDirectus's exact version number is exposed by the OpenAPI SpecEPSS 1.0%CVE-2022-36031MEDIUMUnhandled exception on illegal filename_disk valueEPSS 1.0%CVE-2023-26492MEDIUMDirectus vulnerable to Server-Side Request Forgery On File ImportEPSS 1.0%CVE-2023-45820MEDIUMDirectus crashes on invalid WebSocket messageEPSS 0.8%