CVE-2026-10716

Executive Summary

CVE-2026-10716 is an authenticated SQL injection vulnerability in Directus, a popular open-source headless CMS, affecting versions prior to 12.1.0. The vulnerability is exploitable specifically when the Directus instance is backed by PostgreSQL with the PostGIS extension enabled, allowing an authenticated administrator to inject arbitrary SQL through the collection creation flow. Successful exploitation can lead to full database compromise, including data exfiltration, privilege escalation within the database, and potentially lateral movement to other systems depending on database user permissions.

Technical Analysis

The vulnerability resides in the collection creation endpoint within Directus' administrative API. When an administrator creates a new collection and defines fields, the application accepts a fields[].type parameter that describes the field's data type. For geometry fields (used for spatial data with PostGIS), the application validates that the type value begins with the string "geometry" but fails to properly sanitize or restrict the remainder of the string after the geometry subtype specification.

In PostgreSQL with PostGIS enabled, geometry types follow the format geometry(Subtype, SRID) — for example, geometry(Point, 4326). The flawed validation logic in Directus only checks that the type starts with "geometry", allowing an attacker to append arbitrary SQL after the subtype portion. Because the type value is later interpolated into a SQL CREATE TABLE or ALTER TABLE statement (or a PostgreSQL type casting operation) without parameterization, the attacker-controlled suffix is executed as part of the SQL query.

The attack surface is the authenticated administrative API — specifically the POST /collection endpoint (or equivalent in newer Directus versions). Authentication as an administrator is required, which reduces the baseline risk but does not eliminate it, as administrative accounts can be compromised through other means (phishing, credential reuse, insider threats). Additionally, in multi-tenant deployments where administrators are less trusted, or in environments with poor administrative credential hygiene, this vulnerability becomes significantly more concerning.

The SQL injection is a classic concatenation-based injection within a DDL (Data Definition Language) statement. While DDL injection is sometimes considered less severe than DML injection, it can still be used to exfiltrate data via error-based techniques (if error messages are returned) or blind time-based techniques using pg_sleep(). More critically, it can be used to modify existing tables, create new malicious functions or triggers, or — if the database user has sufficient privileges — to execute operating system commands via PostgreSQL extensions like pg_execute_server_program.

Exploitation Scenarios

Prerequisites: Attacker must have valid administrator credentials for the Directus instance. Target must be running PostgreSQL with PostGIS extension enabled.

Step 1 — Reconnaissance: The attacker identifies a Directus instance. Shodan dorks such as http.title:"Directus" or http.component:"Directus" can surface exposed instances. The attacker confirms the backend database by examining response headers, error pages, or the Directus admin interface's settings page (which may expose database driver information).

Step 2 — Authentication: The attacker authenticates as an administrator. This could be achieved via credential stuffing, phishing, or leveraging previously compromised credentials. Alternatively, if the instance is misconfigured with weak default credentials, direct login is possible.

Step 3 — Crafting the Payload: The attacker navigates to the collection creation flow (e.g., POST /_/collections or POST /collections depending on Directus version). The request body contains a fields array. For the geometry field, the attacker sets the type value to something like:

geometry(Point, 4326); SELECT pg_sleep(10); --

The application's validation sees the string starts with "geometry" and accepts it. When constructing the SQL statement, Directus concatenates this value directly into the query string, producing (conceptually):

CREATE TABLE new_collection (geom geometry(Point, 4326); SELECT pg_sleep(10); --);

The injected SELECT pg_sleep(10) executes, and the -- comments out any trailing syntax.

Step 4 — Time-Based Data Exfiltration: To extract data, the attacker uses a blind time-based technique:

geometry(Point, 4326); SELECT CASE WHEN (SELECT substring(current_database(),1,1)) = 'd' THEN pg_sleep(5) ELSE pg_sleep(0) END; --

By observing response time differences, the attacker can enumerate database names, table names, column names, and ultimately sensitive data.

Step 5 — Error-Based Exfiltration: If the Directus instance returns verbose database error messages, the attacker can use error-based techniques. For example, casting a query result to a type mismatch to force the value into the error message:

geometry(Point, 4326); SELECT CAST((SELECT password FROM directus_users LIMIT 1) AS int); --

Step 6 — Post-Exploitation: With full SQL injection capability, the attacker can:

• Read all data from the directus_users table, including password hashes, to gain access to all other accounts.
• Create a new administrator account for persistence.
• If the PostgreSQL user has SUPERUSER privileges, attempt command execution via:

  CREATE FUNCTION system(cstring) RETURNS int AS '/lib/x86_64-linux-gnu/libc.so.6', 'system' LANGUAGE 'C' STRICT; SELECT system('id');
  

• Escalate to full server compromise via COPY ... FROM PROGRAM if PostgreSQL 9.3+ is used.

Impact Assessment

The business impact of this vulnerability is severe due to the combination of high-privilege authentication requirements and deep database access. According to the CVSS vector (N/A — not yet scored), a provisional assessment places this in the High range (7.0–8.9) due to the limited attack surface (administrator-only) balanced against the high potential impact.

Confidentiality Impact: HIGH — Full database read access allows exfiltration of all stored data, including user credentials, business data, and potentially sensitive customer information. GDPR/CCPA breach notification obligations may apply.

Integrity Impact: HIGH — The attacker can modify, delete, or corrupt any data in the database. In DDL context, they can drop tables, alter schemas, or inject malicious triggers that persistently alter data behavior.

Availability Impact: HIGH — The attacker can drop tables, truncate data, or use time-based payloads to cause denial of service. In a worst-case scenario, the entire database can be destroyed.

Affected Systems: All Directus deployments using PostgreSQL with PostGIS enabled, versions prior to 12.1.0. Deployments using MySQL, SQLite, or Microsoft SQL Server are not affected by this specific vector (though other vulnerabilities may apply).

Blast Radius: The Directus application database, all tenant data in multi-tenant configurations, and potentially the host operating system if PostgreSQL runs with elevated privileges or if OS-level command execution is achieved.

Detection Guidance

Sigma Rule

title: Directus Admin API SQL Injection Attempt (CVE-2026-10716)
id: 3f8a1c2e-5b4d-4e7f-9a2c-6d1b8e4f7a3c
status: experimental
description: Detects attempts to exploit CVE-2026-10716 in Directus collection creation
author: Valtersit Threat Intelligence
date: 2026/02/15
logsource:
  category: web
  product: nginx
  service: http
detection:
  selection_method:
    http.method: POST
  selection_path:
    http.url|contains:
      - '/collections'
      - '/_/collections'
  selection_payload:
    http.user_agent|contains: 'Directus'
  selection_sqli:
    http.body|contains:
      - 'geometry(Point'
      - 'geometry(Polygon'
      - 'geometry(LineString'
      - 'pg_sleep'
      - 'current_database'
      - 'CAST('
      - 'substring('
      - 'CREATE FUNCTION'
      - ';--'
      - ';/*'
  condition: selection_method and selection_path and selection_payload and selection_sqli
  timeframe: 5m
falsepositives:
  - Legitimate use of geometry types with unusual SRID values
  - Database administration tools directly interacting with the API
level: high
tags:
  - attack.t1190
  - cve.2026-10716
  - cwe.89

YARA Rule

rule Directus_CVE_2026_10716_SQL_Injection
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects SQL injection payloads targeting CVE-2026-10716 in Directus collection creation"
        cve = "CVE-2026-10716"
        date = "2026-02-15"
        severity = "high"
    strings:
        $geo_type = /"type"\s*:\s*"geometry\([^"]*(\;|\/\*|\-\-|\bSELECT\b|\bCAST\b|\bpg_sleep\b|\bcurrent_database\b|\bCREATE\b|\bDROP\b|\bINSERT\b|\bUPDATE\b|\bDELETE\b)/ nocase
        $sql_keyword_1 = "pg_sleep" nocase
        $sql_keyword_2 = "current_database" nocase
        $sql_keyword_3 = "substring(" nocase
        $sql_keyword_4 = "CAST(" nocase
        $sql_keyword_5 = "CREATE FUNCTION" nocase
        $sql_comment = ";--"
        $sql_comment_alt = ";/*"
    condition:
        uint16(0) == 0x7B7B and  // "{{"
        any of ($sql_keyword*) and any of ($sql_comment*) and $geo_type
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Directus CVE-2026-10716 SQL Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/collections"; http.request_body; content:"geometry"; nocase; http.request_body; content:"pg_sleep"; nocase; sid:7000107; rev:1; reference:cve,2026-10716; metadata:attack_target Web_Server, deployment Perimeter, signature_severity Critical, created_at 2026_02_15; classtype:web-application-attack;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where event.type == "connection" and destination.port == 443 ]
  [ http where
      http.request.method == "POST" and
      url.path like "*collections*" and
      request.body.text contains "geometry" and
      (request.body.text contains "pg_sleep" or
       request.body.text contains "current_database" or
       request.body.text contains "CAST(" or
       request.body.text contains ";--" or
       request.body.text contains "CREATE FUNCTION")
  ]

Splunk SPL Query

index=web sourcetype=nginx earliest=-24h
| where method=="POST" AND uri_path IN ("/collections", "/_/collections")
| search request_body="*geometry*" AND (request_body="*pg_sleep*" OR request_body="*current_database*" OR request_body="*CAST(*" OR request_body="*;--*" OR request_body="*CREATE FUNCTION*")
| eval threat_signal = case(
    match(request_body, "(?i)pg_sleep"), "time-based SQL injection",
    match(request_body, "(?i)current_database"), "database enumeration",
    match(request_body, "(?i)CAST\("), "error-based SQL injection",
    match(request_body, "(?i);--"), "SQL comment injection",
    match(request_body, "(?i)CREATE FUNCTION"), "OS command execution attempt",
    true(), "suspicious geometry type"
  )
| table _time, src_ip, uri_path, user_agent, threat_signal, request_body
| sort - _time
| stats count by src_ip, threat_signal

Wazuh OSSEC Rule

<group name="directus,">
  <rule id="848588" level="12">
    <if_sid>31122</if_sid>
    <regex>POST /collections|POST /_/collections</regex>
    <description>Directus collection creation API accessed</description>
    <group>directus_web</group>
  </rule>

  <rule id="848589" level="15">
    <if_sid>1071601</if_sid>
    <regex>geometry\([^)]*(pg_sleep|current_database|substring\(|CAST\(|CREATE FUNCTION|;--|;/\*)</regex>
    <description>CVE-2026-10716: Potential SQL injection in Directus geometry field type</description>
    <group>directus_sqli,cve-2026-10716</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source (NVD) claims patch, not independently confirmed)

1) Immediate Mitigations:

• Upgrade to Directus 12.1.0 or later immediately. The patch is claimed but not independently verified; verify the fix in your environment after upgrade.
• If immediate upgrade is not possible, restrict administrative API access to trusted IP addresses using firewall rules or reverse proxy configurations.
• Implement multi-factor authentication (MFA) for all administrator accounts to reduce the risk of credential compromise.
• If MFA is not feasible, strengthen password policies and audit administrator accounts for unusual activity.
• Review PostgreSQL database user permissions: ensure the Directus database user is NOT a superuser and has minimal required privileges. Revoke SUPERUSER if granted.

2) Patch/Upgrade Steps:

• Download Directus 12.1.0 (or later) from the official source (npm package directus or Docker image directus/directus:12.1.0).
• For npm-based deployments:

  npm install directus@12.1.0
  

• For Docker deployments:

  docker pull directus/directus:12.1.0
  docker-compose up -d  # after updating docker-compose.yml image tag
  

• Back up the database and Directus configuration before upgrading.
• After upgrade, verify that the fix prevents SQL injection by testing with a non-destructive payload in a staging environment.

3) Long-Term Hardening:

• Implement the principle of least privilege for the PostgreSQL account used by Directus. Create a dedicated role with only SELECT, INSERT, UPDATE, DELETE, CREATE on the Directus schema, without SUPERUSER or CREATEROLE privileges.
• If PostGIS is not required for your deployment, remove the extension to eliminate this attack surface entirely.
• Deploy a Web Application Firewall (WAF) with rules to detect and block SQL injection patterns in API requests.
• Enable comprehensive audit logging on both the web server and PostgreSQL to detect suspicious activities.
• Implement network segmentation to isolate database servers from direct internet access; Directus should be the only system able to communicate with the database.
• Conduct periodic penetration testing of administrative APIs, especially those reachable by authenticated high-privilege users.
• Subscribe to Directus security advisories and monitor NVD for related CVEs.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-10716
2. Directus Official Site: https://directus.io (for product documentation and release notes)
3. Directus GitHub Releases: https://github.com/directus/directus/releases (for version history and patch verification)
4. PostgreSQL PostGIS Documentation: https://postgis.net/documentation/ (for understanding geometry types and SQL behavior)
5. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/ (Exploit Public-Facing Application)

Threat Actor Campaigns: No known threat actor campaigns or exploit-in-the-wild evidence has been reported for this CVE as of the writing of this report. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog. The PoC status is currently unknown, but the flaw's moderate complexity and administrator-only requirement may limit immediate weaponization.

Report generated for valtersit.com — Enterprise Threat Intelligence Division. This report is based on the CVE intelligence data provided and should be reviewed alongside vendor advisories for the most current information.