What is CVE-2025-30225?

CVE-2025-30225 is a medium-severity vulnerability in Directus, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 5.3/10. Published 2025-03-26.

How severe is CVE-2025-30225?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Resource exhaustion in Directus

CVE-2025-30225

Directus is a real-time API and App dashboard for managing SQL database content. The `@directus/storage-driver-s3` package starting in version 9.22.0 and prior to version 12.0.1, corresponding to Directus starting in version 9.22.0 and prior to 11.5.0, is vulnerable to asset unavailability after a burst of malformed transformations. When making many malformed transformation requests at once, at some point, all assets are served as 403. This causes denial of assets for all policies of Directus, including Admin and Public. Version 12.0.1 of the `@directus/storage-driver-s3` package, corresponding to version 11.5.0 of Directus, fixes the issue.

EPSS: 0.004 (33.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

Affected products

Directus — versions >= 9.22.0, < 11.5.0
Monospace Directus

Weakness classification (CWE)

CWE-770 — Allocation of Resources Without Limits or Throttling

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)

Frequently asked questions

What is CVE-2025-30225?: CVE-2025-30225 is a medium-severity vulnerability in Directus, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 5.3/10. Published 2025-03-26.
How severe is CVE-2025-30225?: Medium severity. CVSS v3 base score is 5.3 out of 10.