Directus versions prior to 11.13.0 contain a stored cross-site scripting (XSS) vulnerability that allows users with 'upload files' and 'edit item' permissions to inject malicious JavaScript via the Block Editor interface. The vulnerability enables attackers to bypass Content Security Policy (CSP) restrictions by leveraging iframe srcdoc attributes referencing uploaded malicious scripts, resulting in persistent XSS execution. This can lead to session hijacking, administrative compromise, data exfiltration, and phishing attacks. A fix is available in version 11.13.0.