CVE-2026-35409

HighCVSS 7.7/10Last modified Jul 24, 2026

Description

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.0, a Server-Side Request Forgery (SSRF) protection bypass has been identified and fixed in Directus. The IP address validation mechanism used to block requests to local and private networks could be circumvented using IPv4-Mapped IPv6 address notation. This vulnerability is fixed in 11.16.0.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Apr 6, 2026
Last modified
Jul 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-35418.8Inappropriate implementation in CSS in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform an out of bounds memory reCVE-2026-354106.1Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, an open redirect vulnerability exists in CVE-2026-354114.3Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus is vulnerable to an open redirecCVE-2026-354128.1Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus' TUS resumable upload endpoint (CVE-2026-354135.3Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, when GRAPHQL_INTROSPECTION=false is confiCVE-2026-354148.1OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with aCVE-2026-354157.8Integer overflow or wraparound in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.CVE-2026-354167.0Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attackerCVE-2026-354177.8Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.CVE-2026-354187.0Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.CVE-2026-354195.5Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally.CVE-2026-35428.8Inappropriate implementation in WebAssembly in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds memo