CVE-2025-30225 Overview
CVE-2025-30225 is a denial of service vulnerability in Directus, a real-time API and application dashboard for managing SQL database content. The flaw resides in the @directus/storage-driver-s3 package from version 9.22.0 up to but not including 12.0.1, which corresponds to Directus versions 9.22.0 through 11.4.x. Attackers can send a burst of malformed asset transformation requests, causing the storage driver to return HTTP 403 responses for all subsequent asset requests. This affects every policy tier, including Admin and Public users. The issue is classified under [CWE-770] Allocation of Resources Without Limits or Throttling.
Critical Impact
Unauthenticated attackers can render all Directus-managed assets unavailable across every user policy by issuing a burst of malformed transformation requests.
Affected Products
- Directus versions 9.22.0 through 11.4.x
- @directus/storage-driver-s3 package versions 9.22.0 through 12.0.0
- Self-hosted Directus deployments using the S3 storage driver
Discovery Timeline
- 2025-03-26 - CVE-2025-30225 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-30225
Vulnerability Analysis
Directus exposes an asset transformation pipeline that generates resized or reformatted variants of media stored in an S3-compatible backend. The @directus/storage-driver-s3 package processes each transformation request against the upstream object store. When a client submits many malformed transformation parameters in rapid succession, the driver enters a state in which subsequent asset requests are rejected with an HTTP 403 response. The condition persists after the malicious burst ends, extending the outage beyond the attack window.
Because the failure mode applies to the storage driver rather than individual authorization checks, it affects every consumer of the assets endpoint. Admin users, authenticated application users, and Public role visitors all lose access to media until the service is remediated.
Root Cause
The vulnerability stems from missing resource governance in the S3 storage driver's handling of transformation errors. Malformed transformation requests are not throttled or isolated from the shared asset pipeline. Repeated failures poison the shared state used to serve subsequent asset requests. The fix in @directus/storage-driver-s3 12.0.1 corrects the error handling and request accounting to prevent legitimate requests from being blocked.
Attack Vector
Exploitation requires only network access to the Directus assets endpoint. No authentication or user interaction is needed. An attacker scripts a burst of HTTP GET requests to /assets/<file-id> with malformed transformation query parameters such as invalid width, height, fit, format, or transforms values. After enough malformed requests accumulate, the asset endpoint begins responding with 403 for every request, producing a durable denial of service.
Further technical detail is available in the GitHub Security Advisory GHSA-j8xj-7jff-46mx.
Detection Methods for CVE-2025-30225
Indicators of Compromise
- Sudden spike in HTTP 403 responses from the /assets/ endpoint across all user policies, including Admin sessions that previously succeeded.
- Bursts of GET requests to /assets/<id> containing malformed transformation query parameters such as invalid width, height, format, or custom transforms values.
- Reports from Public role users that previously accessible media assets have become unavailable simultaneously.
Detection Strategies
- Parse Directus and reverse proxy access logs for elevated ratios of 4xx responses on the /assets/ route compared to baseline.
- Correlate transformation request errors in application logs with subsequent asset request failures from unrelated client IP addresses.
- Alert on repeated requests from a single source that exercise many distinct transformation parameter combinations against the assets endpoint.
Monitoring Recommendations
- Instrument the assets endpoint with per-status-code metrics and set thresholds that trigger alerts when 403 rates deviate from baseline.
- Log the full query string of transformation requests to enable post-incident reconstruction of malformed parameter patterns.
- Track upstream S3 driver error counters to identify saturation events before they impact end users.
How to Mitigate CVE-2025-30225
Immediate Actions Required
- Upgrade Directus to version 11.5.0 or later, which bundles the fixed @directus/storage-driver-s3 12.0.1.
- If direct upgrade is not immediately possible, upgrade the @directus/storage-driver-s3 dependency to 12.0.1 in isolation and redeploy.
- Restart affected Directus instances after upgrade to clear any lingering driver state from prior exploitation attempts.
Patch Information
Directus resolved the issue in @directus/storage-driver-s3 version 12.0.1, shipped as part of Directus 11.5.0. The patch corrects error handling in the S3 storage driver so that malformed transformation requests do not disable asset delivery for other consumers. Refer to the GitHub Security Advisory GHSA-j8xj-7jff-46mx for the authoritative patch reference.
Workarounds
- Place a web application firewall or reverse proxy rule in front of Directus to reject transformation query parameters that fail server-side schema validation before they reach the application.
- Apply per-IP rate limits on the /assets/ endpoint to slow bursts of malformed transformation requests.
- Restrict the set of allowed transformation presets via Directus configuration so that arbitrary transforms values are not accepted from unauthenticated clients.
# Upgrade Directus and the S3 storage driver to patched versions
npm install directus@^11.5.0 @directus/storage-driver-s3@^12.0.1
# Verify installed versions before restarting the service
npm ls directus @directus/storage-driver-s3
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
