CVE-2025-30225

Summary

CVE-2025-30225 is a vulnerability affecting Directus, a real-time API and dashboard for managing SQL database content. Specifically, the `@directus/storage-driver-s3` package, used in Directus versions prior to 11.5.0, is vulnerable to asset unavailability. When subjected to a burst of malformed transformation requests, all assets become unavailable, leading to a denial of service for all Directus policies, including Admin and Public. The issue is resolved in version 12.0.1 of the `@directus/storage-driver-s3` package and version 11.5.0 of Directus.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.