CVE-2026-10716
Received Received - Intake

Authenticated SQL Injection in Directus with PostGIS Geometry Fields

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Fluid Attacks

Description
Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields[].type value starts with geometry but contains attacker-controlled SQL syntax after the geometry subtype.This issue affects Directus: before 12.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-10716
EUVD
EUVD-2026-53519

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
directus directus to 12.1.0 (exc)
directus directus From 12.0.0 (inc) to 12.2.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Directus before version 12.1.0 has an authenticated SQL injection flaw in collection creation when using PostgreSQL with PostGIS enabled. An admin can create a collection with a geometry field whose type starts with 'geometry' but includes attacker-controlled SQL syntax after the subtype. This bypasses validation and allows arbitrary SQL execution in the database.

Detection Guidance

To detect this vulnerability, check if your Directus instance uses PostgreSQL with PostGIS enabled and is running a version prior to 12.1.0. Monitor database logs for unusual SQL queries or time delays during collection creation. Test for time-based SQL injection by attempting to inject pg_sleep() in geometry field types during collection creation.

Impact Analysis

An attacker with admin privileges could exploit this to execute malicious SQL commands directly in the database. This could lead to unauthorized data access, modification, or deletion, including bypassing application-level security controls. The impact includes potential data breaches or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Exploitation may result in non-compliance, potential fines, or legal consequences depending on the affected data and jurisdiction.

Mitigation Strategies

Upgrade Directus to version 12.1.0 or later immediately. If upgrading is not possible, disable PostgreSQL with PostGIS or restrict administrative access to collection creation. Review database logs for signs of exploitation and apply input validation for geometry field types.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-10716. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart