Directus < 11.9.0 - Version Disclosure
CVE-2025-53887
Verified
Description
Directus versions from 9.0.0 before 11.9.0 expose the exact running version through the OpenAPI specification returned by the unauthenticated /server/specs/oas endpoint. The version is placed in the OpenAPI info.version field, letting an unauthenticated attacker fingerprint the precise Directus release. The fix replaces the exact version in that field with a hashed value.
Severity
Medium
CVSS Score
5.3
Exploit Probability
1%
Affected Product
directus
Published Date
August 24, 2026
Template Author
chrisjr404
CVE-2025-53887.yaml
5.3Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE ID:
cve-2025-53887
CWE ID:
cwe-200
Remediation Steps
Upgrade to Directus 11.9.0 or later, where the OpenAPI info.version field no longer contains the exact version.