Directus version number disclosure

GHSA-5mhg-wv8w-p59j · CVE-2024-27296

Published Mar 1, 2024 · Modified Sep 10, 2026

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Impact

Currently the exact Directus version number is being shipped in compiled JS bundles which are accessible without authentication. With this information a malicious attacker can trivially look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version.

Patches

The problem has been resolved in versions 10.8.3 and newer

Workarounds

None

References

WEB https://github.com/directus/directus/security/advisories/GHSA-5mhg-wv8w-p59j
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2024-27296
WEB https://github.com/directus/directus/commit/a5a1c26ac48795ed3212a4c51b9523588aff4fa0
PACKAGE https://github.com/directus/directus

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes