CVE-2025-53887 - CVE House

Back to Database

Status published Medium CVE-2025-53887

Directus's exact version number is exposed by the OpenAPI Spec

5.3 CVSS

Vulnerability Description

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, the exact Directus version number is incorrectly being used as OpenAPI Spec version this means that it is being exposed by the `/server/specs/oas` endpoint without authentication. With the exact version information a malicious attacker can look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version. Version 11.9.0 fixes the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-53887

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from directus

View All →

Directus Vulnerable to Information Leakage in Existing Collections

Directus's conceal fields are searchable if read permissions enabled

Directus Vulnerable to Stored Cross-site Scripting

Directus has Improper Permission Handling on Deleted Fields

Directus allows unauthenticated file upload and file modification due to lacking input sanitization

Affected Vendor

directus

View all reports →

Affected Software

directus

Vulnerable Versions:

>= 9.0.0, < 11.9.0

Timeline

Official Publish: July 14th, 2025

Last Modified: July 15th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1213 Data from Information Repositories

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1041 Exfiltration Over C2 Channel