Is CVE-2025-64747 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-64747 being exploited in the wild.

How severe is CVE-2025-64747?

Medium severity, with a CVSS score of 5.5, published 13 November 2025.

Which products and versions are affected?

directus (npm) SEMVER:introduced=0,fixed=11.13.0.

Is there a fix for CVE-2025-64747?

Yes. directus (npm): upgrade to 11.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-64747 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-64747?

Check whether you run Monospace Directus or directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-64747: Directus stored cross-site scripting in Block Editor

CVE-2025-64747 · Severity: medium · CVSS 5.5 · Published 2025-11-13

Directus is a headless CMS platform that allows users to manage and edit content through a web interface. This vulnerability enables authenticated users with file upload and content editing permissions to inject malicious JavaScript that executes persistently whenever content is viewed. Attackers can bypass security protections (Content Security Policy) by uploading files and manipulating content, potentially stealing user sessions, compromising administrator accounts, or stealing sensitive data displayed in the application.

Technologies: Monospace Directus, directus (npm). Vendors: Monospace, npm.

Quick answers

Is CVE-2025-64747 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-64747 being exploited in the wild.
How severe is CVE-2025-64747?: Medium severity, with a CVSS score of 5.5, published 13 November 2025.
Which products and versions are affected?: directus (npm) SEMVER:introduced=0,fixed=11.13.0.
Is there a fix for CVE-2025-64747?: Yes. directus (npm): upgrade to 11.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-64747 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-64747?: Check whether you run Monospace Directus or directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

directus (npm): upgrade to 11.13.0 or later
```
npm install directus@11.13.0
```

Technical details

The vulnerability is a stored XSS flaw in the Block Editor interface arising from insufficient sanitization of JSON content containing HTML elements. An attacker with both "upload files" and "edit item" permissions can exploit this by: (1) uploading a malicious JavaScript file to obtain a file ID, (2) injecting raw HTML with an iframe srcdoc attribute referencing the uploaded file into Block Editor content via direct API manipulation (PATCH request), and (3) leveraging the iframe srcdoc technique to bypass Content Security Policy protections by creating a new document context that loads the script. The vulnerability requires authenticated access and user interaction (viewing the affected content). The flaw affects Directus versions prior to 11.13.0, which includes the fix.

Affected products

Directus Directus before 11.13.0

Identifiers

CVE-2025-64747
GHSA-vv2v-pw69-8crf

Timeline

2025-11-13: disclosed
2025-11-14: advisory
2025-11-14: patched: Fixed in version 11.13.0

References

https://github.com/directus/directus/security/advisories/GHSA-vv2v-pw69-8crf

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.