PT-2025-12977 · Unknown+1 · @Directus/Storage-Driver-S3+1

Published 2025-03-26 · Updated 2025-11-18 · CVE-2025-30225

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Directus versions 9.22.0 through 11.4.99 @directus/storage-driver-s3 versions 9.22.0 through 12.0.0

Description The issue affects the @directus/storage-driver-s3 package, causing asset unavailability after a burst of malformed transformations. When many malformed transformation requests are made at once, all assets are served as 403, resulting in denial of assets for all policies of Directus, including Admin and Public.

Recommendations For Directus versions 9.22.0 through 11.4.99, update the @directus/storage-driver-s3 package to version 12.0.1 or later. For @directus/storage-driver-s3 versions 9.22.0 through 12.0.0, update to version 12.0.1 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-30225

GHSA-J8XJ-7JFF-46MX

Affected Products

@Directus/Storage-Driver-S3

Directus

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30225.json · Exploit
• https://github.com/directus/directus/security/advisories/GHSA-j8xj-7jff-46mx · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j8xj-7jff-46mx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-30225 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30225 · Security Note
• https://github.com/directus/directus · Note
• https://twitter.com/CVEnew/status/1904954175773086125 · Twitter Post
• https://t.me/cveNotify/143230 · Telegram Post
• https://t.me/cvedetector/21213 · Telegram Post
• https://t.me/cvetracker/19986 · Telegram Post