UpHeron
All vulnerabilities

Servers and applications

CVE-2025-53887

Directus version number disclosure

Severity
Medium 5.3
Published
14 Jul 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
11.9.0
Also known as
GHSA-rmjh-cf9q-pv7q
Sources
NVD, Project advisories (GitHub)

Description

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, the exact Directus version number is incorrectly being used as OpenAPI Spec version this means that it is being exposed by the `/server/specs/oas` endpoint without authentication. With the exact version information a malicious attacker can look for known…

Affected software

SoftwareAffected versions
DirectusServers and applications · cpe:a:monospace:directus
  • From 9.0.0 before 11.9.0
DirectusServers and applications · github:directus/directus
  • From 9.0.0 before 11.9.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-53887
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-53887
  • GitHub Advisory Database https://github.com/advisories/GHSA-rmjh-cf9q-pv7q
  • github.com https://github.com/directus/directus/security/advisories/GHSA-rmjh-cf9q-pv7q