fluidattacks.comThird-party advisory
https://fluidattacks.com/es/advisories/metallica CVE-2026-10716
HIGH
Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation
Record summary
CVE-2026-10716 has a selected CVSS score of 7.5 (high).
Description
Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields[].type value starts with geometry but contains attacker-controlled SQL syntax after the geometry subtype.This issue affects Directus: before 12.1.0.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 5, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
DirectusBrowse Directus / DirectusDefault status: unaffected | CVE List | Before 12.1.0 | affected |
References
5github.comproduct
https://github.com/directus/directus github.compatch
https://github.com/directus/directus/releases github.comVendor advisory
https://github.com/directus/directus/security/advisories/GHSA-chfm-g7r3-vv42 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-10716