CVE-2025-53885: Directus sensitive data exposure in event logging

CVE-2025-53885 · Severity: low · CVSS 3.1 · Published 2025-07-15

Directus is a headless CMS platform that manages content and user data. When administrators configure automated workflows (Flows) to handle user creation or updates, they can inadvertently log sensitive user information such as passwords or personal data to console logs. A malicious admin with workflow configuration privileges can deliberately exploit this to expose other users' sensitive data, potentially leading to account takeover or privacy violations.

Technologies: directus (npm). Vendors: npm.

Quick answers

Is CVE-2025-53885 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-53885 being exploited in the wild.
How severe is CVE-2025-53885?
Low severity, with a CVSS score of 3.1, published 15 July 2025.
Which products and versions are affected?
directus (npm) SEMVER:introduced=9.0.0,fixed=11.9.0.
Is there a fix for CVE-2025-53885?
Yes. directus (npm): upgrade to 11.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-53885 attacked?
It is attacked with local access, in a web application.
Am I affected by CVE-2025-53885?
Check whether you run directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • directus (npm): upgrade to 11.9.0 or later
    npm install directus@11.9.0

Technical details

This vulnerability is a sensitive information disclosure (CWE-532) in Directus event hooks used for user CRUD operations. The root cause is that user data passed to Flows' "Log to Console" operation is not redacted before being written to logs, allowing sensitive fields (passwords, emails, personal information) to be exposed in plaintext. The attack requires high privilege (admin role) and user interaction (configuring the workflow), but once configured, logs any user data created or modified. Affected versions are 9.0.0 through 11.8.x; the fix is available in Directus 11.9.0 and later, which implements sensitive field redaction in logging contexts.

Affected products

  • Directus Directus 9.0.0 through 11.8.x; fixed in 11.9.0

Identifiers

  • CVE-2025-53885
  • GHSA-x3vm-88hf-gpxp

Timeline

  • 2025-07-15: disclosed
  • 2025-07-15: patched: Fix available in Directus 11.9.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.