Listen to this Post
How the CVE Works
Directus Flows allows logging CRUD event data using the “Log to Console” operation with template strings. When user data (including sensitive fields) is processed, it may be inadvertently logged in plaintext. Malicious administrators can exploit this by configuring flows to capture and expose personally identifiable information (PII), passwords, or other confidential data during user creation or updates. The lack of redaction in logs makes this a data exposure risk.
Platform: Directus
Version: <9.x.x
Vulnerability: Sensitive Data Exposure
Severity: Moderate
Date: Jul 14, 2025
Prediction: Patch expected by Aug 1, 2025
What Undercode Say
grep -r "Log to Console" /directus/flows
curl -X POST /flows/configure -d '{"log_user_data":true}'
How Exploit
1. Admin configures Flow with “Log to Console”.
2. Triggers user creation/update.
3. Sensitive data logged unredacted.
Protection from this CVE
- Disable “Log to Console” in production.
- Audit existing flows.
- Apply patch when released.
Impact
- Unauthorized PII access.
- Compliance violations.
- Credential leakage.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
