CVE-2025-53887: Directus Information Disclosure Flaw

CVE-2025-53887 Overview

CVE-2025-53887 is an information disclosure vulnerability in Directus, a real-time API and application dashboard for managing SQL database content. Versions from 9.0.0 up to but not including 11.9.0 expose the exact Directus version number as the OpenAPI Specification version. The /server/specs/oas endpoint returns this data without requiring authentication. Attackers can query the endpoint anonymously to fingerprint the running Directus release and identify known vulnerabilities in the core product or its shipped dependencies. The issue is tracked under [CWE-200] and was fixed in version 11.9.0.

Critical Impact
Unauthenticated attackers can retrieve the exact Directus version number, enabling targeted exploitation of version-specific vulnerabilities in the core product and its dependencies.

Affected Products

Monospace Directus versions 9.0.0 through 11.8.x
Directus deployments exposing the /server/specs/oas endpoint to untrusted networks
Node.js-based Directus installations across all supported platforms

Discovery Timeline

2025-07-15 - CVE-2025-53887 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53887

Vulnerability Analysis

Directus generates an OpenAPI Specification (OAS) document describing its REST API surface. The specification includes a version field, which is intended to describe the API schema version. In affected releases, the application populated this field with the exact Directus release version string instead of an abstract API version.

The /server/specs/oas endpoint that serves this document does not enforce authentication. Any network client that can reach the Directus instance can request the specification and parse the embedded version. Attackers use this version string to correlate the deployment against public vulnerability databases and shipped dependency manifests.

Root Cause

The root cause is an insecure default configuration combined with information exposure through generated metadata. The OpenAPI generator assigned the runtime product version to the info.version field of the specification. Because the specs endpoint is publicly reachable, this metadata leaks to unauthenticated callers. See the GitHub Security Advisory GHSA-rmjh-cf9q-pv7q for the maintainer's analysis.

Attack Vector

Exploitation requires only network access to the Directus HTTP interface. An attacker issues an unauthenticated HTTP GET request to /server/specs/oas and parses the JSON response for the info.version field. The returned value discloses the exact running version, such as 11.8.0. The attacker then cross-references public advisories and dependency lockfiles associated with that release to select an appropriate follow-on exploit. No user interaction, credentials, or elevated privileges are required. Refer to the GitHub Pull Request #25353 for the code changes that address the disclosure.

Detection Methods for CVE-2025-53887

Indicators of Compromise

Unauthenticated HTTP GET requests to /server/specs/oas from external or unexpected source addresses
Repeated reconnaissance patterns combining requests to /server/specs/oas, /server/info, and /server/ping
Follow-on exploitation attempts targeting known Directus or Node.js dependency CVEs matching the disclosed version

Detection Strategies

Enable HTTP access logging on the reverse proxy in front of Directus and alert on unauthenticated access to /server/specs/* paths
Correlate requests to the specs endpoint with subsequent authentication failures or exploitation attempts against the same source IP
Baseline expected clients of the OpenAPI endpoint and flag deviations from known integrations

Monitoring Recommendations

Ingest Directus and reverse proxy logs into a centralized analytics platform for retention and query
Alert on User-Agent strings associated with automated scanners (nuclei, httpx, generic Python or curl clients) hitting the specs endpoint
Monitor for outbound requests from the Directus host that follow inbound reconnaissance, indicating potential chained exploitation

How to Mitigate CVE-2025-53887

Immediate Actions Required

Upgrade Directus to version 11.9.0 or later, which replaces the version field with a non-sensitive value
Restrict network access to the Directus administrative and specs endpoints using firewall rules or reverse proxy allowlists
Audit historical access logs for prior requests to /server/specs/oas from untrusted networks

Patch Information

The fix is included in Directus release v11.9.0. The maintainers replaced the exposed version identifier in the OpenAPI generator. Review the GitHub commit e74f3e4 for the exact code change applied to the specs generation logic.

Workarounds

Block or return HTTP 401/403 for /server/specs/oas at the reverse proxy layer until the upgrade is deployed
Place Directus behind an authenticating gateway that requires a valid session cookie or API token for all /server/* routes
Restrict management interfaces to a VPN or private network segment to limit unauthenticated exposure

bash

# Example NGINX rule to block unauthenticated access to the specs endpoint
location = /server/specs/oas {
    deny all;
    return 403;
}