CVE-2025-30353: Directus's webhook trigger flows can leak sensitive data
Describe the Bug
In Directus, when a Flow with the "Webhook" trigger and the "Data of Last Operation" response body encounters a ValidationError thrown by a failed condition operation, the API response includes sensitive data. This includes environmental variables, sensitive API keys, user accountability information, and operational data.
This issue poses a significant security risk, as any unintended exposure of this data could lead to potential misuse.
!Image !Image !Image
To Reproduce
Steps to Reproduce: 1. Create a Flow in Directus with: - Trigger: Webhook - Response Body: Data of Last Operation 2. Add a condition that is likely to fail. 3. Trigger the Flow with any input data that will fail the condition. 4. Observe the API response, which includes sensitive information like: - Environmental variables ($env) - Authorization headers - User details under $accountability - Previous operational data.
Expected Behavior: In the event of a ValidationError, the API response should only contain relevant error messages and details, avoiding the exposure of sensitive data.
Actual Behavior: The API response includes sensitive information such as: - Environment keys (FLOWSENVALLOWLIST) - User accountability (role, user, etc.) - Operational logs (currentpayments, $last), which might contain private details.
Other sources
Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the "Webhook" trigger and the "Data of Last Operation" response body encounters a ValidationError thrown by a failed condition operation, the API response includes sensitive data. This includes environmental variables, sensitive API keys, user accountability information, and operational data. This issue poses a significant security risk, as any unintended exposure of this data could lead to potential misuse. Version 11.5.0 fixes the issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/directusto a version that resolves this vulnerability.Fixed in 11.5.0 - Upgrade
Upgrade
Directusto a version that resolves this vulnerability.Fixed in 11.5.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30353?
The severity of CVE-2025-30353 is classified as high due to the exposure of sensitive data in API responses.
How do I fix CVE-2025-30353?
To fix CVE-2025-30353, upgrade Directus to version 11.5.0 or later and ensure that any conditions in your Flow are correctly validated.
What data is exposed in CVE-2025-30353?
CVE-2025-30353 exposes sensitive environmental variables and other potentially confidential data when a ValidationError occurs.
Which versions of Directus are affected by CVE-2025-30353?
Versions of Directus between 9.12.0 and 11.5.0 are affected by CVE-2025-30353.
How does CVE-2025-30353 impact my application?
CVE-2025-30353 can compromise the security of your application by unintentionally revealing sensitive information through API responses.