PT-2025-12978 · Unknown+1 · @Directus/Storage-Driver-S3+1

Published 2025-03-26 · Updated 2025-11-18 · CVE-2025-30350

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Directus versions 9.22.0 through 11.4.99 @directus/storage-driver-s3 versions 9.22.0 through 12.0.0

Description The issue affects the @directus/storage-driver-s3 package, causing asset unavailability after a burst of HEAD requests. Some tools use the HEAD method to check the existence of files, and when making many HEAD requests at once, all assets are eventually served as 403, resulting in denial of assets for all policies of Directus, including Admin and Public.

Recommendations For Directus versions 9.22.0 through 11.4.99, update the @directus/storage-driver-s3 package to version 12.0.1 or later. For @directus/storage-driver-s3 versions 9.22.0 through 12.0.0, update to version 12.0.1 or later.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-30350

GHSA-RV78-QQRQ-73M5

Affected Products

@Directus/Storage-Driver-S3

Directus

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30350.json · Exploit
• https://github.com/directus/directus/security/advisories/GHSA-rv78-qqrq-73m5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30350 · Security Note
• https://osv.dev/vulnerability/GHSA-rv78-qqrq-73m5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-30350 · Vendor Advisory
• https://github.com/directus/directus · Note
• https://t.me/cvetracker/19987 · Telegram Post
• https://t.me/cveNotify/143231 · Telegram Post
• https://twitter.com/CVEnew/status/1904954174904963499 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1905119058179023336 · Twitter Post
• https://t.me/cvedetector/21210 · Telegram Post