HIGH 7.5 NVD
CVE-2026-10716
Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An admini
Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields[].type value starts with geometry but contains attacker-controlled SQL syntax after the geometry subtype.This issue affects Directus: before 12.1.0.
References
- https://fluidattacks.com/es/advisories/metallica
- https://github.com/directus/directus
- https://github.com/directus/directus/releases#release-v12.1.0
- https://github.com/directus/directus/security/advisories/GHSA-chfm-g7r3-vv42
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-08-05 via NVD.
vulnfeed aggregates 9344 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.