PT-2026-30327 · Directus · Directus

Pov9En · Published 2026-04-04 · Updated 2026-04-06 · CVE-2026-35410

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.16.1

Description Directus is a real-time API and App dashboard for managing SQL database content. An open redirect exists in the login redirection logic because the isLoginRedirectAllowed function incorrectly identifies certain malformed URLs as internal, allowing attackers to bypass redirect allow-list validation and redirect users to arbitrary external domains after successful authentication. A parser differential exists between the server-side URL validation logic and how browsers interpret URL path segments containing backslashes, leading to misclassification of URLs. This can be exploited in SSO authentication flows to redirect users to attacker-controlled sites after authentication.

Recommendations Update to Directus version 11.16.1 or later.

Fix

Open Redirect

RCE

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-601

CWE-20

CWE-184

Related Identifiers

CVE-2026-35410

GHSA-CF45-HXWJ-4CFJ

Affected Products

Directus

References · 5

• https://github.com/directus/directus/security/advisories/GHSA-cf45-hxwj-4cfj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35410 · Security Note
• https://osv.dev/vulnerability/GHSA-cf45-hxwj-4cfj · Vendor Advisory
• https://github.com/directus/directus · Note
• https://twitter.com/CVEnew/status/2041282873622507558 · Twitter Post