Vulnerability Bulletins |
CVE-2026-10716 |
|
| Affected software | POSTGRESQL |
| Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields[].type value starts with geometry but contains attacker-controlled SQL syntax after the geometry subtype.This issue affects Directus: before 12.1.0. | |
Link: |
|
| https://nvd.nist.gov/vuln/detail/CVE-2026-10716 | |