CVE-2026-35409

HIGH SEVERITY

CVSS Score & Metrics

Base Score

7.7 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N                                    

Vulnerability Description

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.0, a Server-Side Request Forgery (SSRF) protection bypass has been identified and fixed in Directus. The IP address validation mechanism used to block requests to local and private networks could be circumvented using IPv4-Mapped IPv6 address notation. This vulnerability is fixed in 11.16.0.

Vulnerability Details

Published Date

April 04, 2026

Last Modified

April 07, 2026

CWE ID

CWE-918

Source

GitHub

Vendor

npm

Product

directus

External References

https://github.com/directus/directus/security/advisories/GHSA-wv3h-5fx7-966h
https://github.com/advisories/GHSA-wv3h-5fx7-966h

CVE-2026-35409

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment