PT-2026-33454 · Craftql · Craftql

Published 2026-04-17 · Updated 2026-04-19 · CVE-2026-31317

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Craftql versions prior to 1.3.8

Description Server-Side Request Forgery (SSRF) allows an attacker to execute arbitrary code via the 'vendor/markhuot/craftql/src/Listeners/GetAssetsFieldSchema.php' file.

Recommendations Update to a version newer than 1.3.7. As a temporary workaround, restrict access to the 'vendor/markhuot/craftql/src/Listeners/GetAssetsFieldSchema.php' file to minimize the risk of exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-31317

GHSA-8WMW-PRW8-2GGM

Affected Products

Craftql

References · 7

• 🔥 https://github.com/stormmmg/craftql_ssrf/blob/master/craftql-ssrf-en/README_detail.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-31317 · Security Note
• https://osv.dev/vulnerability/GHSA-8wmw-prw8-2ggm · Vendor Advisory
• https://github.com/markhuot/craftql · Note
• https://github.com/stormmmg/craftql_ssrf · Note
• https://twitter.com/CVEnew/status/2045889746010808345 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2045217065322078716 · Twitter Post