CVE-2025-30353

Summary

CVE-2025-30353 is a vulnerability affecting Directus, an API and App dashboard for managing SQL database content, from versions 9.12.0 to 11.4.9. When a Flow with a "Webhook" trigger and the "Data of Last Operation" response body encounters a ValidationError due to a failed condition operation, the API response inadvertently discloses sensitive data. This includes environmental variables, API keys, user accountability information, and operational data, posing a significant security risk. Any unintended exposure of this data could lead to potential misuse. The issue has been resolved in version 11.5.0.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.