CVE-2025-64747
Medium · 5.5Directus is Vulnerable to Stored Cross-site Scripting
CVSS
5.5
EPSS
0.3%
Published
Nov 14, 2025
CISA due date
—
The record
A stored cross-site scripting (XSS) vulnerability exists that allows users with `upload files` and `edit item` permissions to inject malicious JavaScript through the Block Editor interface. Attackers can bypass Content Security Policy (CSP) restrictions by combining file uploads with iframe srcdoc attributes, resulting in persistent XSS execution.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | directus | 0 | 11.13.0 |
Related vulnerabilities
- GHSA-vv2v-pw69-8crf Directus is Vulnerable to Stored Cross-site Scripting Same vulnerability
- CVE-2026-39942 Directus is a real-time API and App dashboard for managing SQL database content. Also affects directus
- CVE-2026-39943 Directus is a real-time API and App dashboard for managing SQL database content. Also affects directus
- CVE-2026-35410 Directus is a real-time API and App dashboard for managing SQL database content. Also affects directus
- CVE-2026-35411 Directus is a real-time API and App dashboard for managing SQL database content. Also affects directus
- CVE-2026-35412 Directus is a real-time API and App dashboard for managing SQL database content. Also affects directus
- CVE-2026-35441 Directus is a real-time API and App dashboard for managing SQL database content. Also affects directus
- CVE-2026-35413 Directus is a real-time API and App dashboard for managing SQL database content. Also affects directus