CVE-2025-53887

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, the exact Directus version number is incorrectly being used as OpenAPI Spec version this means that it is being exposed by the `/server/specs/oas` endpoint without authentication. With the exact version information a malicious attacker can look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version. Version 11.9.0 fixes the issue.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Jul 15, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-538889.8RIOT-OS, an operating system that supports Internet of Things devices, has an ineffective size check implemented with `assert()` can lead toCVE-2025-538896.5Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.9.0, DirCVE-2025-53899.8A vulnerability, which was classified as critical, has been found in JeeWMS up to 20250504. Affected by this issue is the function dogeneratCVE-2025-538909.8pyload is an open-source Download Manager written in pure Python. An unsafe JavaScript evaluation vulnerability in pyLoad’s CAPTCHA processiCVE-2025-538914.3The timelineofficial/Time-Line- repository contains the source code for the TIME LINE website. A vulnerability was found in the TIME LINE weCVE-2025-538925.3Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTMLCVE-2025-538936.5File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and editCVE-2025-538958.8ZITADEL is an open source identity management system. Starting in version 2.53.0 and prior to versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.CVE-2025-538968.1Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could cause under certain circCVE-2025-538976.8Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, this vulnerability could allow an external attacker tCVE-2025-538997.2Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an incCVE-2025-53909.8A vulnerability, which was classified as critical, was found in JeeWMS up to 20250504. This affects the function filedeal of the file /syste