PT-2025-29527 · Directus · Directus

Licitdev · Published 2025-07-14 · Updated 2025-07-29 · CVE-2025-53886

Positive Technologies (AI Summary)

CVSS v3.1

4.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Directus versions 9.0.0 through 11.8.9

Description: Directus is a real-time API and App dashboard for managing SQL database content. When using Directus Flows with the WebHook trigger, all incoming request details, including security-sensitive data like access and refresh tokens in cookies, are logged. Malicious administrators with access to the logs can hijack user sessions within the token expiration time after triggering the Flow.

Recommendations: Update to Directus version 11.9.0 or later.

Exploit

Fix

Information Disclosure

Insertion into Log File

Weakness Enumeration

CWE-200

CWE-532

CWE-212

Related Identifiers

CVE-2025-53886

GHSA-F24X-RM6G-3W5V

Affected Products

Directus

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53886.json · Exploit
• https://github.com/directus/directus/pull/25354 · Patch
• https://github.com/directus/directus/commit/22be460c76957708d67fdd52846a9ad1cbb083fb · Patch
• https://osv.dev/vulnerability/GHSA-f24x-rm6g-3w5v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-53886 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53886 · Security Note
• https://github.com/directus/directus · Note
• https://github.com/directus/directus/commit/859f664f56fb50401c407b095889cea38ff580e5 · Note
• https://github.com/directus/directus/security/advisories/GHSA-f24x-rm6g-3w5v · Note
• https://github.com/directus/directus/releases/tag/v11.9.0 · Note
• https://twitter.com/CVEnew/status/1944907782890676283 · Twitter Post
• https://twitter.com/jmdevlabs/status/1950098594767188289 · Twitter Post
• https://t.me/cvenotify/128953 · Telegram Post
• https://t.me/cvetracker/27834 · Telegram Post