CVE-2026-35409

Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import

View on CVE.org
Published Apr 6, 2026 CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Description
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.0, a Server-Side Request Forgery (SSRF) protection bypass has been identified and fixed in Directus. The IP address validation mechanism used to block requests to local and private networks could be circumvented using IPv4-Mapped IPv6 address notation. This vulnerability is fixed in 11.16.0.

Analysis

AI-generated

Technical impact

The vulnerability involves a Server‑Side Request Forgery (SSRF) protection bypass that allows attackers to use IPv4‑Mapped IPv6 addresses to trick Directus into making requests to local or private networks. Because the IP address validation was compromised, an attacker could cause the system to contact internal resources, potentially expose sensitive data or facilitate further attacks. This weakness is classified as CWE‑918.

Affected Systems

Directus products prior to version 11.16.0 are affected. Users running any Directus instance before 11.16.0 should consider themselves vulnerable.

Risk and Exploitability

The CVSS score is 7.7, indicating a high severity. Although EPSS is not available, the exploit is straightforward once the file‑import endpoint is exposed. The vulnerability is not listed in the CISA KEV catalog, but the high score suggests that attackers could target exposed Directus installations.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Directus to version 11.16.0 or later
  • Verify your deployment has been updated by checking the version number or running a version query
  • Test the file import functionality to ensure the SSRF protection is effective
  • Monitor logs for any unexpected internal requests after the upgrade

Generated by OpenCVE AI on April 7, 2026 at 01:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-wv3h-5fx7-966h Directus: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import
History
Type Values Removed Values Added
First Time appeared Monospace
Monospace directus
CPEs cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*
Vendors & Products Monospace
Monospace directus
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Directus
Directus directus
Vendors & Products Directus
Directus directus
Type Values Removed Values Added
Description Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.0, a Server-Side Request Forgery (SSRF) protection bypass has been identified and fixed in Directus. The IP address validation mechanism used to block requests to local and private networks could be circumvented using IPv4-Mapped IPv6 address notation. This vulnerability is fixed in 11.16.0.
Title Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}
Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Apr 8, 2026, 2:05 PM
Reserved
Apr 2, 2026, 5:03 PM

View source JSON

Updated
Apr 8, 2026, 2:04 PM

JSON

Status
Analyzed
Published
Apr 6, 2026, 10:16 PM
Modified
Jul 24, 2026, 9:10 PM

View source JSON

No data.

Updated
Apr 7, 2026, 9:36 AM

JSON