CVE-2025-30352: Directus `search` query parameter allows enumeration of non permitted fields

March 26, 2025

The search query parameter allows users with access to a collection to filter items based on fields they do not have permission to view. This allows the enumeration of unknown field contents.

References

github.com/advisories/GHSA-7wq3-jr35-275c
github.com/directus/directus
github.com/directus/directus/commit/ac5a9964d9926f20dc063a74cb417dc7bbad676d
github.com/directus/directus/security/advisories/GHSA-7wq3-jr35-275c
nvd.nist.gov/vuln/detail/CVE-2025-30352

Code Behaviors & Features

Detect and mitigate CVE-2025-30352 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →