SQL Injection in Directus

CVE-2026-10716

Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields[].type value starts with geometry but contains attacker-controlled SQL syntax after the geometry subtype.This issue affects Directus: before 12.1.0.

Vulnerability class: SQL Injection

EPSS: 0.003 (24.1th percentile) — read the EPSS interpretation.