{"id":"CVE-2026-31317","details":"Craftql v1.3.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitrary code via the vendor/markhuot/craftql/src/Listeners/GetAssetsFieldSchema.php file","aliases":["GHSA-8wmw-prw8-2ggm"],"modified":"2026-10-20T12:00:26.893401837Z","published":"2026-04-17T00:00:00Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31317.json","cna_assigner":"mitre"},"references":[{"type":"WEB","url":"https://github.com/stormmmg/craftql_ssrf/"},{"type":"WEB","url":"https://github.com/stormmmg/craftql_ssrf/blob/master/craftql-ssrf-en/README_detail.md"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31317.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31317"},{"type":"PACKAGE","url":"https://github.com/markhuot/craftql"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/markhuot/craftql","events":[{"introduced":"0"},{"last_affected":"d01af3b463cc9134dd8df5f6743240cc5b5de13b"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"last_affected":"1.3.7"}],"source":"DESCRIPTION"}]}}],"versions":["1.3.7","1.3.6","1.3.5","1.3.4","1.3.3","1.3.1","1.3.0","1.2.1","1.2.0","1.1.0","1.0.0","1.0.0-beta.29","1.0.0-beta.28","1.0.0-beta.27","1.0.0-beta.26","1.0.0-beta.25","1.0.0-beta.24","1.0.0-beta.23","1.0.0-beta.22","1.0.0-beta.21","1.0.0-beta.19","1.0.0-beta.18","1.0.0-beta.17","1.0.0-beta.16","1.0.0-beta.15","1.0.0-beta.14","1.0.0-beta.13","1.0.0-beta.12","1.0.0-beta.11","1.0.0-beta.10","1.0.0-beta.9","1.0.0-beta.8","1.0.0-beta.7","1.0.0-beta.6","1.0.0-beta.5","1.0.0-beta.4","1.0.0-beta.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31317.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}