Quick answers
- Is CVE-2025-30353 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-30353 being exploited in the wild.
- How severe is CVE-2025-30353?
- Low severity, with a CVSS score of 3.1, published 26 March 2025.
- Which products and versions are affected?
- directus (npm) SEMVER:introduced=9.12.0,fixed=11.5.0.
- Is there a fix for CVE-2025-30353?
- Yes. directus (npm): upgrade to 11.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-30353 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2025-30353?
- Check whether you run directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- directus (npm): upgrade to 11.5.0 or later
npm install directus@11.5.0
Technical details
The vulnerability exists in Directus's webhook trigger flow implementation when combined with the "Data of Last Operation" response body setting. When a ValidationError is thrown by a failed condition operation, the error response includes sensitive data from the flow execution context such as $env (environment variables), FLOWS_ENV_ALLOW_LIST configuration, $accountability (user role and identity), authorization headers, and $last (previous operational data). The vulnerability is triggered by sending any input to a webhook endpoint configured with a failing condition, and no authentication is required (AV:N, PR:N). Directus versions 9.12.0 through 11.4.x are affected; version 11.5.0 and later include the fix.
Affected products
- Directus directus 9.12.0 through 11.4.x
Identifiers
- CVE-2025-30353
- GHSA-fm3h-p9wm-h74h
Timeline
- 2025-03-26: disclosed
- 2025-03-26: patched: Version 11.5.0 includes the fix