Executive brief
Directus is a headless CMS platform that allows users to manage and edit content through a web interface. This vulnerability enables authenticated users with file upload and content editing permissions to inject malicious JavaScript that executes persistently whenever content is viewed. Attackers can bypass security protections (Content Security Policy) by uploading files and manipulating content, potentially stealing user sessions, compromising administrator accounts, or stealing sensitive data displayed in the application.
Technical details
The vulnerability is a stored XSS flaw in the Block Editor interface arising from insufficient sanitization of JSON content containing HTML elements. An attacker with both "upload files" and "edit item" permissions can exploit this by: (1) uploading a malicious JavaScript file to obtain a file ID, (2) injecting raw HTML with an iframe srcdoc attribute referencing the uploaded file into Block Editor content via direct API manipulation (PATCH request), and (3) leveraging the iframe srcdoc technique to bypass Content Security Policy protections by creating a new document context that loads the script. The vulnerability requires authenticated access and user interaction (viewing the affected content). The flaw affects Directus versions prior to 11.13.0, which includes the fix.
Affected products
- Directus Directus before 11.13.0
Timeline
- 2025-11-13: disclosed
- 2025-11-14: advisory
- 2025-11-14: patched: Fixed in version 11.13.0