{"action":"Upgrade directus to 11.5.0 or later.","affected":[{"fixed":"11.5.0","introduced":"9.0.0-alpha.4"}],"component":"directus","cve_ids":["CVE-2025-30352"],"ecosystem":"npm","epss":0.00376,"exploited":false,"fixed_versions":["11.5.0"],"ghsa_id":"GHSA-7wq3-jr35-275c","id":"tcs_01M5KFB31X9ZFZX4F1DD6FS95S","modified_at":"2026-09-10T03:49:48.445189160Z","published_at":"2025-03-26T18:44:23Z","references":["https://osv.dev/vulnerability/GHSA-7wq3-jr35-275c","https://github.com/directus/directus/security/advisories/GHSA-7wq3-jr35-275c","https://nvd.nist.gov/vuln/detail/CVE-2025-30352","https://github.com/directus/directus/commit/ac5a9964d9926f20dc063a74cb417dc7bbad676d","https://github.com/directus/directus"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-7wq3-jr35-275c","url":"https://osv.dev/vulnerability/GHSA-7wq3-jr35-275c"}],"summary":"Directus `search` query parameter allows enumeration of non permitted fields"}