CMS

directus/directus

The flexible backend for all your projects 🐰 Turn your DB into a headless CMS, admin panels, or apps with a custom UI, instant APIs, auth & more.

#api#cms#graphql#app#database#vue#sqlite#mysql#postgresql#mssql#directus#node#headless-cms#no-code#typescript#javascript#data-visualization#sql#composable#mariadb

スコア

/ 100

Star

35,711

Fork

4,758

Open Issue

344

サイズ

432MB

言語

TypeScript ★

最終push

0 日前

Docker

🐳 両方 ★

採点内訳

過去CVE 20件 (やや多い)

✓

直近 push: 0 日前

✓

得意言語 (TypeScript)

✓

オープンissue 344件

✓

大規模 (432MB)

—

Docker 対応 (Dockerfile + compose)

✓

10k–50k: 中級 (★35,711)

—

※ 各項目の重みは「採点ルール」を参照。合計は 0 で底打ち。

過去の SecurityAdvisory (20 件)

HIGHGHSA-38hg-ww64-rrwc CVE-2026-354422026/4/2
Authenticated Users Can Extract Concealed Fields via Aggregate Queries
MEDIUMGHSA-ph52-67fq-75wj CVE-2026-354412026/4/2
GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limits
HIGHGHSA-6q22-g298-grjh CVE-2026-354412026/4/2
Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check Resolver
MEDIUMGHSA-mvv8-v4jj-g47j CVE-2026-399432026/4/2
Sensitive fields exposed in revision history
HIGHGHSA-qqmv-5p3g-px89 CVE-2026-354122026/4/2
TUS Upload Authorization Bypass Allows Arbitrary File Overwrite
HIGHGHSA-wv3h-5fx7-966h CVE-2026-354092026/4/2
SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import
MEDIUMGHSA-wxwm-3fxv-mrvx CVE-2026-354132026/4/2
GraphQL Schema SDL Disclosure Setting
MEDIUMGHSA-cf45-hxwj-4cfj CVE-2026-354102026/4/2
Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow
MEDIUMGHSA-q75c-4gmv-mg9x CVE-2026-354112026/4/2
Open Redirect in Admin 2FA Setup Page
HIGHGHSA-393c-p46r-7c95 CVE-2026-399422026/4/2
Broken Access Control in File Management API
HIGHGHSA-8m32-p958-jg99 CVE-2026-354082026/4/2
Missing Cross-Origin Opener Policy
MEDIUMGHSA-jr94-gj3h-c8rf CVE-2026-261852026/2/12
User Enumeration via Password Reset Timing Attack
MEDIUMGHSA-3573-4c68-g8cc CVE-2026-220322026/1/6
Open redirect in SAML
MEDIUMGHSA-cph6-524f-3hgr CVE-2025-647492025/11/13
Information Leakage: Existing Collections
MEDIUMGHSA-8jpw-gpr4-8cmh CVE-2025-647482025/11/13
Conceal fields are searchable if read permissions enabled
MEDIUMGHSA-vv2v-pw69-8crf CVE-2025-647472025/11/13
Store XSS
MEDIUMGHSA-9x5g-62gj-wqf2 CVE-2025-647462025/11/13
Improper Permission Handling on Deleted Fields in Directus
CRITICALGHSA-mv33-9f6j-pfmc CVE-2025-557462025/8/20
Unauthenticated file upload and file modification due to lacking input sanitization
MEDIUMGHSA-7cvf-pxgp-42fc CVE-2025-538892025/7/14
Missing permission checks for manual trigger Flows
MEDIUMGHSA-rmjh-cf9q-pv7q CVE-2025-538872025/7/14
Directus version number disclosure