SQL Injection in Directus
CVE-2026-10716
Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields[].type value…
Vulnerability class: SQL Injection
Affected products
- Directus — versions 0
Weakness classification (CWE)
References
- help@fluidattacks.com (third-party-advisory)
- help@fluidattacks.com (product)
- help@fluidattacks.com (vendor-advisory)
- help@fluidattacks.com (patch)