Vulnerability Description
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, the SSRF protection on Directus's file-import-from-URL feature can be bypassed using the address 0.0.0.0 because api/src/request/is-denied-ip.ts treats 0.0.0.0 as a keyword for local interfaces but never blocks the literal address itself. On Linux and macOS, connecting to 0.0.0.0 reaches localhost, so an authenticated user with file-upload rights can make the server fetch internal services through the /files/import endpoint and retrieve the response as a downloadable file. This issue is fixed in version 12.0.0.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Monospace | Directus | < 12.0.0 |
Related Weaknesses (CWE)
References
- https://github.com/directus/directus/commit/f75b25fa44b05c6022b20f231c20bc6e50f0Patch
- https://github.com/directus/directus/pull/27606Issue TrackingPatch
- https://github.com/directus/directus/releases/tag/v12.0.0Release Notes
- https://github.com/directus/directus/security/advisories/GHSA-j5h6-vqc3-phqhVendor Advisory
FAQ
What is CVE-2026-61835?
CVE-2026-61835 is a vulnerability with a CVSS score of 7.7 (HIGH). Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, the SSRF protection on Directus's file-import-from-URL feature can be bypassed using the address 0.0.0...
How severe is CVE-2026-61835?
CVE-2026-61835 has been rated HIGH with a CVSS base score of 7.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-61835?
Check the references section above for vendor advisories and patch information. Affected products include: Monospace Directus.