Directus versions prior to 12.0.0 implement an SSRF protection that incorrectly permits the literal IP address 0.0.0.0. This weakness is a Server Side Request Forgery (CWE-918). The code that checks denied IPs treats 0.0.0.0 as a keyword for local interfaces but does not block the address itself. On Linux and macOS, connecting to 0.0.0.0 resolves to localhost, which means an authenticated user with file‑upload privileges can instruct the server to fetch arbitrary internal services through the /files/import endpoint and extract the response as a downloadable file. The vulnerability therefore enables internal network reconnaissance and potential data exfiltration through the API.

Any installation of Directus running a version earlier than 12.0.0 is susceptible. The issue is fixed in the 12.0.0 release and later versions; upgrading to 12.0.0 or newer removes the bypass path.

The CVSS score is 7.7, indicating high severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentication with file‑upload rights and an internal network reachable from the Directus host. Once performed, the attacker can download the content of internal services as files, compromising confidentiality and potentially enabling further attacks on internal infrastructure.