UpHeron
All vulnerabilities

Servers and applications

CVE-2025-53885

Sensitive user data is not being redacted when logged via event hooks

Severity
Medium 4.2
Published
14 Jul 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
11.9.0
Also known as
GHSA-x3vm-88hf-gpxp
Sources
NVD, Project advisories (GitHub)

Description

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flows to handle CRUD events for users it is possible to log the incoming data to console using the "Log to Console" operation and a template string. Malicious admins can log sensitive data from other users when they are created or updated.…

Affected software

SoftwareAffected versions
DirectusServers and applications · cpe:a:monospace:directus
  • From 9.0.0 before 11.9.0
DirectusServers and applications · github:directus/directus
  • From 9.0.0 before 11.9.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-53885
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-53885
  • GitHub Advisory Database https://github.com/advisories/GHSA-x3vm-88hf-gpxp
  • github.com https://github.com/directus/directus/security/advisories/GHSA-x3vm-88hf-gpxp