VULNERABILITY INTELLIGENCE

CVE-2026-31317

CVSS score7.5 HIGH

EPSS probability0.34%

CISA KEVNot currently listed

Published2026-04-17

Last modified2026-06-17

Description

Craftql v1.3.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitrary code via the vendor/markhuot/craftql/src/Listeners/GetAssetsFieldSchema.php file