CVE-2026-35409

HIGH

Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import

Title source: cna

Description

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.0, a Server-Side Request Forgery (SSRF) protection bypass has been identified and fixed in Directus. The IP address validation mechanism used to block requests to local and private networks could be circumvented using IPv4-Mapped IPv6 address notation. This vulnerability is fixed in 11.16.0.

References (1)

[X_Refsource_Confirm] https://github.com/directus/directus/security/advisories/GHSA-wv3h-5fx7-966h

Scores

CVSS v3 7.7

EPSS 0.0001

EPSS Percentile 1.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Details

CWE

CWE-918

Status published

Products (3)

directus/directus < 11.16.0

monospace/directus < 11.16.0

npm/directus 0 - 11.16.0npm

Published Apr 06, 2026

Tracked Since Apr 07, 2026