CVE-2026-35409CWE-918

Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import

High · published April 6, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
30.6
In the wild
Unconfirmed
What it is

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.0, a Server-Side Request Forgery (SSRF) protection bypass has been identified and fixed in Directus. The IP address validation mechanism used to block requests to local and private networks could be circumvented using IPv4-Mapped IPv6 address notation. This vulnerability is fixed in 11.16.0.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00378 · 30.6th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-04-06T21:31Z
EPSS history
Timeline
  • 06 APR 21:31Z
    Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import
    cvelistv5