Directus allows an administrator to create a collection that includes a geometry field. When PostgreSQL with PostGIS is enabled, the field definition can be crafted so that the value of fields[].type begins with the word geometry and then embeds arbitrary SQL syntax. This leads to an authenticated SQL injection that can be used to run any statement against the underlying database. The consequence is a full compromise of confidentiality, integrity, and availability for data stored in the Directus instance, as well as the ability to modify or delete application data and potentially gain broader system access. The weakness is classified as a standard SQL injection (CWE‑89).

All installations of Directus versions earlier than 12.1.0 that are running PostgreSQL with PostGIS activated are affected. The vulnerability applies regardless of operating system – Linux, macOS, or Windows. Deployments using other database back‑ends or without PostGIS are not impacted.

The vulnerability has a CVSS score of 7.5, indicating high severity. EPSS data is not available, and the issue is not listed in CISA’s KEV catalog. Attackers must possess administrator rights to create a collection, but the vulnerability allows the attacker to inject arbitrary SQL and therefore control the database’s contents. The exploitation path is relatively straightforward for an authenticated user and does not require additional privileges beyond those granted to a Directus administrator.