OpenAPI Specification Exposure in Directus API Management Tool
CVE-2025-53887
Key Information:
Badges
What is CVE-2025-53887?
A vulnerability exists in the Directus API management tool where the exact version number is revealed through the OpenAPI Specification at the '/server/specs/oas' endpoint without requiring authentication. This exposure allows attackers to identify potential weaknesses in the Directus core and its dependencies tied to the specific version of the application in use. As a result, it enables malicious actors to exploit known vulnerabilities, posing a risk to databases and potentially compromising their integrity. The issue has been addressed in version 11.9.0, which mitigates this exposure.
Affected Version(s)
directus >= 9.0.0, < 11.9.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.