PT-2025-46914 · Directus · Directus

Published 2025-11-13 · Updated 2026-04-05 · CVE-2025-64748

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.13.0

Description Directus allows authenticated users to search concealed or sensitive fields when they have read permissions. While the actual values are masked, successful matches can be detected through returned records, enabling enumeration attacks on sensitive data. The vulnerability affects fields like token, tfa secret, and password within the directus users collection. Attackers can potentially verify valid authentication tokens, identify accounts using known compromised passwords, and confirm the existence of sensitive values. The default application access permissions can automatically expose deployments using recommended settings.

Recommendations Update to Directus version 11.13.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2025-64748

GHSA-8JPW-GPR4-8CMH

Affected Products

Directus

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64748.json · Exploit
• https://github.com/directus/directus/security/advisories/GHSA-8jpw-gpr4-8cmh · Vendor Advisory
• https://github.com/directus/directus/commit/7737d56e096f95edfbdf861a3c08999ad31ce204 · Patch
• https://osv.dev/vulnerability/GHSA-8jpw-gpr4-8cmh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64748 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64748 · Vendor Advisory
• https://github.com/directus/directus · Note
• https://twitter.com/dailycve/status/2040715005197275327 · Twitter Post
• https://t.me/cveNotify/142748 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1989186946984223188 · Twitter Post
• https://t.me/cveNotify/145131 · Telegram Post
• https://t.me/CVEtracker/37298 · Telegram Post