AIKIDO-2026-410222

TL;DR

Directus builds a collection's table columns from client-supplied fields[].type values during collection creation. Any field whose type begins with geometry is routed to the PostgreSQL geometry helper, which places the derived subtype into a raw geometry(...) DDL fragment without an allowlist or neutralization. On PostgreSQL with the PostGIS extension, a crafted subtype terminates the intended expression and appends attacker-controlled SQL that the database executes as a blind, time-based injection. The fix restricts geometry field types to a known set of supported subtypes.