CVE-2026-35409

HIGH

Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-35409 has a selected CVSS score of 7.7 (high).

Description

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.0, a Server-Side Request Forgery (SSRF) protection bypass has been identified and fixed in Directus. The IP address validation mechanism used to block requests to local and private networks could be circumvented using IPv4-Mapped IPv6 address notation. This vulnerability is fixed in 11.16.0.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 8, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

directus

Browse directus / directus
CVE List< 11.16.0affected

directus

Browse npm / directus
GitHub AdvisoryBefore 11.16.0 · Fixed in 11.16.0affected

References

3