CVE-2026-35409 HIGH

CVE-2026-35409: Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import

Vendor Directus
Product directus
Weakness CWE-918 · SSRF
Published April 6, 2026
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

7.7/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.0, a Server-Side Request Forgery (SSRF) protection bypass has been identified and fixed in Directus. The IP address validation mechanism used to block requests to local and private networks could be circumvented using IPv4-Mapped IPv6 address notation. This vulnerability is fixed in 11.16.0.

Key dates

02Disclosure timeline

April 6, 2026 CVE published
April 8, 2026 Record updated