CVE-2025-538875.3MediumCWE-200

CVE-2025-53887: Directus's exact version number is exposed by the OpenAPI Spec

directus

Affected: directus · Exploitation: check available, not yet exploited

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

1.0%probability of exploitation in the next 30 days

63rd percentile

050100

Higher than 63% of scored CVEs

5.3MediumCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, the exact Directus version number is incorrectly being used as OpenAPI Spec version this means that it is being exposed by the `/server/specs/oas` endpoint without authentication. With the exact version information a malicious attacker can look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version. Version 11.9.0 fixes the issue.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

directus · directus>= 9.0.0, < 11.9.0

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
CISA KEV: Not listed
Public check: Directus < 11.9.0 - Version Disclosure · nuclei template in projectdiscovery/nuclei-templates
Weakness: Information Exposure · Information Disclosure
Vendor: directus
Published: July 2025
Band: Check available, not yet exploited, July 2025

CoverageNo articles yet

No CyberSIXT article names CVE-2025-53887 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.