GHSA-8wmw-prw8-2ggm

Craftql vulnerable to Server-Side Request Forgery

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-31317

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	markhuot/craftql	<= 1.3.7	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Craftql v1.3.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitrary code via the vendor/markhuot/craftql/src/Listeners/GetAssetsFieldSchema.php file.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-31317 advisory
https://github.com/markhuot/craftql package
https://github.com/stormmmg/craftql_ssrf web
https://github.com/stormmmg/craftql_ssrf/blob/master/craftql-ssrf-en/README_detail.md web