CVE-2026-61835

Analyzed Analyzed - Analysis Complete

SSRF Bypass via 0.0.0.0 in Directus

Publication date: 2026-07-15

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, the SSRF protection on Directus's file-import-from-URL feature can be bypassed using the address 0.0.0.0 because api/src/request/is-denied-ip.ts treats 0.0.0.0 as a keyword for local interfaces but never blocks the literal address itself. On Linux and macOS, connecting to 0.0.0.0 reaches localhost, so an authenticated user with file-upload rights can make the server fetch internal services through the /files/import endpoint and retrieve the response as a downloadable file. This issue is fixed in version 12.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-28

Generated

2026-08-05

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-03

NVD

CVE-2026-61835

EUVD

EUVD-2026-44672

Affected Vendors & Products

Vendor	Product	Version / Range
monospace	directus	to 12.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability is an SSRF (Server-Side Request Forgery) protection bypass in Directus versions prior to 12.0.0. It allows an authenticated user with file-upload rights to bypass IP restrictions by using the address 0.0.0.0. The system treats 0.0.0.0 as a keyword for local interfaces but fails to block it explicitly, enabling access to internal services like databases or APIs bound to localhost.

Detection Guidance

To detect this vulnerability, check if your Directus instance is running a version prior to 12.0.0. Use commands like 'curl -s http://your-directus-instance/version' or check the admin dashboard version info. Monitor network logs for file-import-from-URL requests targeting 0.0.0.0 or internal services.

Impact Analysis

An attacker could exploit this to make the server fetch internal services and retrieve responses as downloadable files. This could lead to unauthorized access to sensitive data like databases, caches, or internal APIs, potentially exposing confidential information or internal system details.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's data protection principles or HIPAA's security requirements for safeguarding protected health information. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Directus to version 12.0.0 or later immediately. Block 0.0.0.0 and :: in firewall rules. Restrict file-upload permissions to trusted users only. Review and update SSRF protection configurations.

Hi! I’m here to help you understand CVE-2026-61835. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70