Vulnerability record · CVE-2026-61835 · published 15 July 2026

CVE-2026-61835: Monospace directus server-side request forgery (ssrf) vulnerability

Monospace · Directus

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, the SSRF protection on Directus's file-import-from-URL feature can be bypassed using the address 0.0.0.0 because api/src/request/is-denied-ip.ts treats 0.0.0.0 as a keyword for local interfaces but never blocks the literal address itself. On Linux and macOS, connecting to 0.0.0.0 reaches localhost, so an authenticated user with file-upload rights can make the server fetch internal services through the /files/import endpoint and retrieve the response as a downloadable file. This issue is fixed in version 12.0.0.

7.7 CVSS 3.1 High EPSS 0.41% · top 67.6% CWE-918 · Server-side request forgery (SSRF)

7.7CVSS 3.1 base score

0.41%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References

28 Jul 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Directus Monospace

References

Link	Tags
https://github.com/directus/directus/commit/f75b25fa44b05c6022b20f231c20bc6e50f021d7	Patch
https://github.com/directus/directus/pull/27606	Issue TrackingPatch
https://github.com/directus/directus/releases/tag/v12.0.0	Release Notes
https://github.com/directus/directus/security/advisories/GHSA-j5h6-vqc3-phqh	Vendor Advisory

Track CVE-2026-61835 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-26969Monospace directus vulnerabilityIn Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.EPSS 0.92%26 Dec 2022 9.3CVE-2026-35408Monospace directus origin validation error vulnerabilityDirectus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus's Single Sign-On (SSO) login pages lacked…EPSS 0.19%6 Apr 2026 8.8CVE-2026-39942Monospace directus improper access control vulnerabilityDirectus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, the PATCH /files/{id} endpoint accepts a user-cont…EPSS 0.36%9 Apr 2026 8.6CVE-2026-61836Monospace directus insecure direct object reference vulnerabilityDirectus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key der…EPSS 0.47%15 Jul 2026 8.2CVE-2024-27295Monospace directus vulnerabilityDirectus is a real-time API and App dashboard for managing SQL database content. The password reset mechanism of the Directus backend allows attacker…EPSS 0.70%1 Mar 2024 8.1CVE-2026-35412Monospace directus incorrect authorization vulnerabilityDirectus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus' TUS resumable upload endpoint (/files/tu…EPSS 0.39%6 Apr 2026 8.1CVE-2026-35442Monospace directus information exposure vulnerabilityDirectus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, aggregate functions (min, max) applied to fields w…EPSS 0.43%6 Apr 2026 7.7CVE-2026-35409Monospace directus server-side request forgery (ssrf) vulnerabilityDirectus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.0, a Server-Side Request Forgery (SSRF) protection by…EPSS 0.38%6 Apr 2026

Source: NIST National Vulnerability Database (record CVE-2026-61835), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.