CVE-2026-35409

Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import

State: Published
Severity: 7.7 High
Published: Apr 6, 2026
Updated: Apr 8, 2026
Reserved: Apr 2, 2026

Description

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.0, a Server-Side Request Forgery (SSRF) protection bypass has been identified and fixed in Directus. The IP address validation mechanism used to block requests to local and private networks could be circumvented using IPv4-Mapped IPv6 address notation. This vulnerability is fixed in 11.16.0.

Scores

CVSS	Score	Vector	Source
3.1	7.7 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
directusdirectus	< 11.16.0Affected

References

https://github.com/directus/directus/security/advisories/GHSA-wv3h-5fx7-966h

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.