Quick answers
- Is CVE-2025-53886 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-53886 being exploited in the wild.
- How severe is CVE-2025-53886?
- Low severity, with a CVSS score of 3.1, published 15 July 2025.
- Which products and versions are affected?
- directus (npm) SEMVER:introduced=0,fixed=11.9.0.
- Is there a fix for CVE-2025-53886?
- Yes. directus (npm): upgrade to 11.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-53886 attacked?
- It is attacked over the network.
- Am I affected by CVE-2025-53886?
- Check whether you run directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- directus (npm): upgrade to 11.9.0 or later
npm install directus@11.9.0
Technical details
This is a sensitive information exposure vulnerability (CWE-200, CWE-532) in Directus's Flow logging mechanism. When a WebHook trigger is invoked, all incoming request details—including HTTP headers and cookies containing access and refresh tokens—are logged without redaction or sanitization. The vulnerability requires high privilege (admin account) to access the logs and user interaction (triggering the Flow), but allows an attacker to harvest valid session tokens and hijack user sessions within the token lifetime. The issue was fixed in version 11.9.0, with the commit 859f664f56fb50401c407b095889cea38ff580e5 implementing token redaction in logs.
Affected products
- Directus Directus >=9.0.0, before 11.9.0
Identifiers
- CVE-2025-53886
- GHSA-f24x-rm6g-3w5v
Timeline
- 2025-07-15: disclosed
- 2025-07-15: patched: Fixed in version 11.9.0