CVE-2026-61835

Name of the Vulnerable Software and Affected Versions Directus versions prior to 12.0.0

Description An authenticated user with file-upload permissions can bypass Server-Side Request Forgery (SSRF) protections—a flaw where a server is tricked into making requests to an unintended location—via the file-import-from-URL feature. This occurs because the system treats 0.0.0.0 as a keyword for local interfaces but fails to block the literal address. On Linux and macOS, this allows the server to reach localhost through the '/files/import' endpoint, enabling the retrieval of internal service responses as downloadable files.

Recommendations Update to version 12.0.0. Restrict access to the '/files/import' endpoint for users who do not strictly require file-upload rights.