漏洞描述
Directus versions from 9.0.0 before 11.9.0 expose the exact running version through the OpenAPI specification returned by the unauthenticated /server/specs/oas endpoint. The version is placed in the OpenAPI info.version field, letting an unauthenticated attacker fingerprint the precise Directus release. The fix replaces the exact version in that field with a hashed value.
影响产品
暂无结构化产品信息。
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
github.comhttps://github.com/directus/directus/security/advisories/GHSA-rmjh-cf9q-pv7q↗github.comhttps://github.com/directus/directus/pull/25353↗github.comhttps://github.com/directus/directus/commit/e74f3e4e92edc33b5f83eefb001a3d2a85af17a3↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2025-53887↗