PT-2026-68256 · Postgresql Global Development Group+2 · Postgresql+2
CVSS v4.0
7.5
High
| Vector | AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Directus versions prior to 12.1.0
Description
An authenticated SQL injection exists in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can exploit this by creating a collection with a geometry field where the
fields[].type value begins with geometry but includes malicious SQL syntax following the geometry subtype.Recommendations
Update to version 12.1.0 or later.
Exploit
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Directus
Postgis
Postgresql