4.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-53885

CVE-2025-53885: Directus is vulnerable to sensitive data exposure as user data is not being redacted when logged

Summary

When using Directus Flows to handle CRUD events for users it is possible to log the incoming data to console using the "Log to Console" operation and a template string.

Impact

Malicious admins can log sensitive data from other users when they are created or updated.

Workarounds

Avoid logging sensitive data to the console outside the context of development.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-53885

CVE-2025-53885:

4.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
directus	npm	>= 9.0.0, < 11.9.0	11.9.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-x3vm-88hf-gpxp, concerns sensitive data exposure in Directus's Flow feature. The core of the issue lies in the 'Log to Console' operation, which failed to redact sensitive information before logging. The provided patch commit 859f664f56fb50401c407b095889cea38ff580e5 clearly points to the api/src/flows.ts file and the FlowManager.executeOperation method as the place where the fix was implemented.

My analysis of the commit diff shows that a new logic block was added specifically for operations of type log. This new block uses a redactObject utility to sanitize the data (keyedData) before it is passed to applyOptionsData, which prepares the data for the logging handler. The vulnerable version of the code passed the raw, unredacted keyedData directly to applyOptionsData. Therefore, any runtime profile capturing the exploitation of this vulnerability would show FlowManager.executeOperation being called to process the malicious 'log' operation. This makes it the precise vulnerable function. The root cause is the lack of output sanitization for data used in a logging feature.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

4.2

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-53885: Directus is vulnerable to sensitive data exposure as user data is not being redacted when logged

Summary

Impact

Workarounds

CVE-2025-53885:

4.2

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

CVE-2025-53885: Directus is vulnerable to sensitive data exposure as user data is not being redacted when logged

Summary

Impact

Workarounds

4.2

4.2

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI