CVE-2026-61835 | BDVDB-2026-348764 Detail

Description#

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, the SSRF protection on Directus's file-import-from-URL feature can be bypassed using the address 0.0.0.0 because api/src/request/is-denied-ip.ts treats 0.0.0.0 as a keyword for local interfaces but never blocks the literal address itself. On Linux and macOS, connecting to 0.0.0.0 reaches localhost, so an authenticated user with file-upload rights can make the server fetch internal services through the /files/import endpoint and retrieve the response as a downloadable file. This issue is fixed in version 12.0.0.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-07-15Record published in the CVE List.
2. Version 22026-07-21Most recent update recorded in the CVE List.