The vulnerability involves a Server‑Side Request Forgery (SSRF) protection bypass that allows attackers to use IPv4‑Mapped IPv6 addresses to trick Directus into making requests to local or private networks. Because the IP address validation was compromised, an attacker could cause the system to contact internal resources, potentially expose sensitive data or facilitate further attacks. This weakness is classified as CWE‑918.

Directus products prior to version 11.16.0 are affected. Users running any Directus instance before 11.16.0 should consider themselves vulnerable.

The CVSS score is 7.7, indicating a high severity. Although EPSS is not available, the exploit is straightforward once the file‑import endpoint is exposed. The vulnerability is not listed in the CISA KEV catalog, but the high score suggests that attackers could target exposed Directus installations.