Directus XSS bug