Monospace Directus 9.0.0 Release Candidate 59 for Node.js

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:monospace:directus:9.0.0:rc59:*:*:*:node.js:*:*

part: a version: 9.0.0 update: rc59

VendorMonospace (09b3b513-a26f-50e4-96f2-93db4b101585)
ProductDirectus (92d1fa78-4478-51fc-9c97-b7794fc9a631)
Edition*
Language*
Software edition*
Target softwarenode.js
Target hardware*
Other*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:docker/directus/directus purl2cpe 2026-06-01 10:11:35.610933
pkg:github/directus/directus purl2cpe 2026-06-01 10:11:35.610935
pkg:golang/github.com/directus/directus purl2cpe 2026-06-01 10:11:35.610936

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2025-30352 vulnerable 2026-06-08 07:16:59.871084 Directus `search` query parameter allows enumeration of non permitted fields
MEDIUM (5.3)
Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0-alpha.4 and prior to version 11.5.0, the `search` query parameter allows users with access to a collection to filter items based on fields they do not have permission to view. This allows the enumeration of unknown field contents. The searchable columns (numbers & strings) are not checked against permissions when injecting the `where` clauses for applying the search query. This leads to the possibility of enumerating those un-permitted fields. Version 11.5.0 fixes the issue.
Published: 2025-03-26T17:18:39.567Z
Updated: 2025-03-27T15:15:07.652Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.