PT-2025-46912 · Directus · Directus

Published 2025-11-13 · Updated 2025-11-17 · CVE-2025-64747

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.13.0

Description Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting (XSS) issue exists that allows users with upload files and edit item permissions to inject malicious JavaScript through the Block Editor interface. Attackers can bypass Content Security Policy (CSP) restrictions by combining file uploads with iframe srcdoc attributes, resulting in persistent XSS execution.

Recommendations Update to version 11.13.0 or later.

Exploit

Fix

XSS

RCE

Weakness Enumeration

CWE-79

CWE-20

Related Identifiers

CVE-2025-64747

GHSA-VV2V-PW69-8CRF

Affected Products

Directus

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64747.json · Exploit
• https://github.com/directus/directus/security/advisories/GHSA-vv2v-pw69-8crf · Vendor Advisory
• https://github.com/directus/directus/commit/d23525317f0780f04aa1fe7a99171a358e43cb2e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-64747 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64747 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vv2v-pw69-8crf · Vendor Advisory
• https://github.com/directus/directus · Note
• https://t.me/cveNotify/142747 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1oxcbz9/resumen_diario_de_vulnerabilidades_14112025 · Reddit Post
• https://t.me/CVEtracker/37297 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1ozp1t6/resumen_diario_de_vulnerabilidades_17112025 · Reddit Post
• https://twitter.com/VulmonFeeds/status/1989184387250807229 · Twitter Post