Vulnerabilities

Vulnerability · CVE-2026-10716

SQL injection via geometry field type in PostgreSQL/PostGIS collection creation

Published Aug 5, 2026 · catalog updated Aug 6, 2026 · SQL injection via geometry

Last checked Nov 2, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-10716. EPSS is 0.42%. Act only if a listed version of SQL injection via geometry is installed.

Severity

High7.2

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.42%

Remediation

Version ranges on file

Affected products

npm directus

### Summary Directus is vulnerable to authenticated SQL injection during collection creation when the database is PostgreSQL with the PostGIS extension enabled. A field declared with a geometry type is not validated against the set of supported geometry subtypes, allowing an attacker-controlled subtype string to be embedded into the raw DDL used to create the collection's table. ### Details When a collection is created, Directus builds the table's columns from the request's entries. Any field whose begins with is routed to the PostgreSQL geometry helper, which derives a subtype from the field type and places it into a raw type fragment. Because this fragment is emitted literally into the generated statement, a crafted subtype can terminate the intended expression and append additional SQL, which is then executed by the database. The relevant components are: - selects the geometry code path using a broad check rather than an allowlist of supported subtypes. - inserts the derived subtype into the raw geometry type fragment without neutralization. The injected SQL runs as the database role that Directus is configured to use. It is exploitable as a blind, time-based injection, which also enables conditional data extraction through timing. ### Impact An authenticated actor with permission to create collections can execute arbitrary SQL against the Directus database, in the context of the configured database role. Depending on that role's privileges, this can lead to disclosure, modification, or deletion of database contents, and to denial of service through blocking or resource-intensive queries. Creating collections is restricted to administrators, so exploitation requires an administrator account (or an equivalent account able to create collections). This significantly limits exposure, since such accounts are already highly privileged within Directus; the security-relevant effect is that this application-level privilege is converted into direct SQL execution at the dat