CVE-2025-31481
2 advisories.
Packagist/api-platform/graphql CVE-2025-31481: high 7.5, EPSS 0.47%
GraphQL query operations security can be bypassed
Action: Upgrade api-platform/graphql to 3.4.17 or later.
composer require api-platform/graphql:4.0.22composer require api-platform/graphql:3.4.17composer require api-platform/graphql:4.1.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0-alpha.1 | 4.0.22 | - |
| 0 | 3.4.17 | - |
| 4.1.0-alpha.1 | 4.1.5 | - |
Fixed versions
| 4.0.22 | 3.4.17 | 4.1.5 |
Sources
- osv: GHSA-cg3c-245w-728m
- https://github.com/api-platform/core/security/advisories/GHSA-cg3c-245w-728m
- https://nvd.nist.gov/vuln/detail/CVE-2025-31481
- https://github.com/api-platform/core/commit/55712452b4f630978537bdb2a07dc958202336bb
- https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568
- https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/core/CVE-2025-31481.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/graphql/CVE-2025-31481.yaml
- https://github.com/api-platform/core
- https://github.com/api-platform/core/releases/tag/v3.4.17
- https://github.com/api-platform/core/releases/tag/v4.1.5
CVE-2025-31481 · published · modified · JSON
Packagist/api-platform/core CVE-2025-31481: high 7.5, EPSS 0.47%
GraphQL query operations security can be bypassed
Action: Upgrade api-platform/core to 3.4.17 or later.
composer require api-platform/core:4.0.22composer require api-platform/core:3.4.17composer require api-platform/core:4.1.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0-alpha.1 | 4.0.22 | - |
| 0 | 3.4.17 | - |
| 4.1.0-alpha.1 | 4.1.5 | - |
Fixed versions
| 4.0.22 | 3.4.17 | 4.1.5 |
Sources
- osv: GHSA-cg3c-245w-728m#Packagist/api-platform/core
- https://github.com/api-platform/core/security/advisories/GHSA-cg3c-245w-728m
- https://nvd.nist.gov/vuln/detail/CVE-2025-31481
- https://github.com/api-platform/core/commit/55712452b4f630978537bdb2a07dc958202336bb
- https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568
- https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/core/CVE-2025-31481.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/graphql/CVE-2025-31481.yaml
- https://github.com/api-platform/core
- https://github.com/api-platform/core/releases/tag/v3.4.17
- https://github.com/api-platform/core/releases/tag/v4.1.5
CVE-2025-31481 · published · modified · JSON