What is the CVSS score of CVE-2026-31317?

CVE-2026-31317 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-31317?

Craftql PHP library versions 1.3.7 and earlier contain a Server-Side Request Forgery (SSRF) vulnerability that could allow attackers to extract sensitive information or pivot to internal systems,…

How to fix or mitigate CVE-2026-31317?

Within 24 hours: Identify all systems using Craftql PHP library versions ≤1.3.7 via dependency scanning and asset inventory. Within 7 days: Isolate affected systems from production if they handle sensitive data or have access to internal services; contact Craftql maintainers for patch availability timeline. Within 30 days: Upgrade to Craftql version 1.3.8 or later once released and tested; if unavailable, implement network segmentation to restrict server outbound requests and deploy WAF rules to block malformed asset field requests.

PHP CVE-2026-31317

EUVD-2026-23428 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-17 mitre

GHSA-8wmw-prw8-2ggm

PHP SSRF RCE N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 20, 2026 - 16:23 vuln.today

CVSS changed

Apr 20, 2026 - 16:22 NVD

7.5 (HIGH)

EUVD ID Assigned

Apr 17, 2026 - 14:15 euvd

EUVD-2026-23428

Analysis Generated

Apr 17, 2026 - 14:15 vuln.today

CVE Published

Apr 17, 2026 - 00:00 nvd

HIGH 7.5

DescriptionCVE.org

Craftql v1.3.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitrary code via the vendor/markhuot/craftql/src/Listeners/GetAssetsFieldSchema.php file

AnalysisAI

Server-Side Request Forgery (SSRF) in Craftql PHP library versions 1.3.7 and earlier enables remote attackers to force the server to make unintended requests, potentially leading to arbitrary code execution. The vulnerability resides in the GetAssetsFieldSchema.php listener component. No active exploitation is confirmed (not in CISA KEV), but a proof-of-concept repository with detailed exploitation documentation exists on GitHub. Despite the CVSS 7.5 rating, the extremely low EPSS score (0.01%, 0th percentile) indicates minimal real-world exploitation activity observed to date. The description claims RCE capability, but the CVSS vector shows only confidentiality impact (C:H/I:N/A:N), suggesting the SSRF may enable information disclosure that could chain into RCE rather than direct code execution - verification with vendor advisories needed.

Technical ContextAI

Craftql is a GraphQL plugin for Craft CMS written in PHP. The vulnerability is classified as CWE-918 (Server-Side Request Forgery), where an attacker can manipulate the application to make HTTP requests to arbitrary internal or external resources. The flaw exists in the vendor/markhuot/craftql/src/Listeners/GetAssetsFieldSchema.php file, likely in code handling asset field schema generation where user-controlled input (possibly GraphQL query parameters or asset URLs) is used to construct server-side requests without proper validation. SSRF vulnerabilities typically allow attackers to scan internal networks, access cloud metadata services (AWS EC2 metadata, Kubernetes API), or interact with internal services not exposed to the internet. The claim of arbitrary code execution suggests the SSRF may be exploitable to reach vulnerable internal services or leverage protocols beyond HTTP (file://, gopher://, etc.) to achieve RCE, though this escalation path is not detailed in the CVSS vector which shows no integrity or availability impact.

RemediationAI

Upgrade to Craftql version 1.3.8 or later if available, though no confirmed patched version is referenced in the CVE data or researcher documentation. Check the official GitHub repository (github.com/markhuot/craftql) for updates or security patches addressing CVE-2026-31317. If no patch exists and Craftql is required, implement network-level controls: deploy web application firewall (WAF) rules to detect and block SSRF payloads in GraphQL queries, specifically monitoring requests to the assets field schema endpoint. Restrict outbound connections from the web application server using egress filtering, allowing only necessary external domains and blocking access to cloud metadata endpoints (169.254.169.254, fd00:ec2::254), internal RFC1918 networks (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and localhost (127.0.0.1/8). Note that egress restrictions may break legitimate external asset fetching features if Craftql relies on retrieving remote resources. Consider disabling asset field schema functionality in GetAssetsFieldSchema.php if not business-critical, though this may degrade GraphQL API functionality. Implement application-level URL validation with allowlists for permitted domains and protocols, rejecting file://, gopher://, dict://, and other non-HTTP schemes. Given the absence of vendor engagement indicated by missing advisories, evaluate migrating to actively maintained GraphQL solutions for Craft CMS.