CVE-2025-30353

CVE-2025-30353 is an information disclosure vulnerability in Directus, a real-time API and app dashboard for managing SQL database content. It affects versions starting from 9.12.0 up to but not including 11.5.0. The issue occurs in Flows configured with a Webhook trigger and the "Data of Last Operation" response body setting. When such a Flow encounters a ValidationError from a failed condition operation, the API response leaks sensitive data, including environmental variables, sensitive API keys, user accountability information, and operational data. The vulnerability has a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) and is associated with CWE-200.

Unauthenticated attackers (PR:N) can exploit this vulnerability remotely over the network (AV:N) with low complexity and no user interaction required. By triggering a Flow via its Webhook endpoint in a way that causes a ValidationError in a condition operation—such as sending a malformed payload—they receive an API response containing the exposed sensitive data. This scope-changing attack (S:C) results in high confidentiality impact (C:H), enabling potential misuse of the leaked credentials, keys, or operational details for further compromise.

The Directus security advisory (GHSA-fm3h-p9wm-h74h) confirms that upgrading to version 11.5.0 resolves the issue by preventing the inclusion of sensitive data in error responses. Security practitioners should prioritize patching affected Directus instances and review any Flows using Webhook triggers with "Data of Last Operation" response bodies for exposure risks.