Is CVE-2025-30352 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-30352 being exploited in the wild.

How severe is CVE-2025-30352?

Low severity, with a CVSS score of 3.1, published 26 March 2025.

Which products and versions are affected?

directus (npm) SEMVER:introduced=9.0.0-alpha.4,fixed=11.5.0.

Is there a fix for CVE-2025-30352?

Yes. directus (npm): upgrade to 11.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-30352 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2025-30352?

Check whether you run directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-30352: Directus search query parameter information disclosure

CVE-2025-30352 · Severity: low · CVSS 3.1 · Published 2025-03-26

Directus is a popular headless CMS platform that allows users to access and manage collections of data through query parameters. A flaw in the search functionality allows authenticated users to discover sensitive field values they shouldn't have permission to view—such as email addresses, password hashes, and administrative tokens—by filtering search results on restricted fields. This could lead to unauthorized exposure of confidential user and system information.

Technologies: directus (npm). Vendors: npm.

Quick answers

Is CVE-2025-30352 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-30352 being exploited in the wild.
How severe is CVE-2025-30352?: Low severity, with a CVSS score of 3.1, published 26 March 2025.
Which products and versions are affected?: directus (npm) SEMVER:introduced=9.0.0-alpha.4,fixed=11.5.0.
Is there a fix for CVE-2025-30352?: Yes. directus (npm): upgrade to 11.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-30352 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2025-30352?: Check whether you run directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

directus (npm): upgrade to 11.5.0 or later
```
npm install directus@11.5.0
```

Technical details

The vulnerability is an information disclosure flaw (CWE-200) in Directus's search query parameter handling. When processing the search parameter to filter collection items, the application does not enforce field-level permissions on searchable string and numeric columns before injecting them into the WHERE clause. An attacker with collection read access can craft search queries referencing restricted fields, enumerate their contents, and extract sensitive data such as email addresses, password hashes, and API tokens. The vulnerability affects versions 9.0.0-alpha.4 through 11.4.x and is fixed in version 11.5.0 (commit ac5a9964d9926f20dc063a74cb417dc7bbad676d). Attack vector is network-based with no privilege or user interaction requirement.

Affected products

Directus Directus 9.0.0-alpha.4 to 11.4.x

Identifiers

CVE-2025-30352
GHSA-7wq3-jr35-275c

Timeline

2025-03-26: disclosed
2025-03-26: patched: Fixed in Directus 11.5.0

References

https://github.com/directus/directus/security/advisories/GHSA-7wq3-jr35-275c

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.