CVE-2026-61835
published 2026-07-15CVE-2026-61835: Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, the SSRF protection on Directus's file-import-from-URL…
PriorityP349high7.7CVSS 3.1
AVNACLPRLUINSCCHINAN
EPSS
0.41%
33.9th percentile
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, the SSRF protection on Directus's file-import-from-URL feature can be bypassed using the address 0.0.0.0 because api/src/request/is-denied-ip.ts treats 0.0.0.0 as a keyword for local interfaces but never blocks the literal address itself. On Linux and macOS, connecting to 0.0.0.0 reaches localhost, so an authenticated user with file-upload rights can make the server fetch internal services through the /files/import endpoint and retrieve the response as a downloadable file. This issue is fixed in version 12.0.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| directus | directus | < 12.0.0 | 12.0.0 |
| directus | directus | >= 0 < 12.0.0 | 12.0.0 |
| monospace | directus | < 12.0.0 | 12.0.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Directus up to 11.x SSRF Protection is-denied-ip.ts 0.0.0.0 server-side request forgery
vuldb·2026-07-30·CVSS 7.7
CVE-2026-61835 [HIGH] Directus up to 11.x SSRF Protection is-denied-ip.ts 0.0.0.0 server-side request forgery
A vulnerability classified as problematic was found in Directus up to 11.x. This affects an unknown function of the file api/src/request/is-denied-ip.ts of the component SSRF Protection. Executing a manipulation of the argument 0.0.0.0 can lead to server-side request forgery.
This vulnerability appears as CVE-2026-61835. The attack may be performed from remote. There is no available exploit.
Upgrading the affected component is advised.
GHSA
Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
ghsa·2026-07-20
CVE-2026-61835 [HIGH] CWE-918 Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
### Summary
The SSRF protection on Directus's file-import-from-URL feature can be bypassed using the address `0.0.0.0`. While `127.0.0.1` and other internal addresses are denied, `0.0.0.0` is not added to the blocklist. On Linux and macOS, connecting to `0.0.0.0` reaches localhost, so an authenticated user with file-upload rights can make the server fetch internal services and retrieve the response as a downloadable file (full-read SSRF).
### Affected Versions
- **Affected:** Directus `= 12.0.0`
### Details
Directus uses a deny-list config, `IMPORT_IP_DENY_LIST`, whose default value is `['0.0.0.0', '169.254.169.254']`.
The issue is in how `api/src/request/is-denied-ip.ts` processes this list. When it encounters the entry `0
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-15
Published