CVE-2025-31485
2 advisories.
Packagist/api-platform/graphql CVE-2025-31485: high 7.5
GraphQL grant on a property might be cached with different objects
Action: Upgrade api-platform/graphql to 3.4.17 or later.
composer require api-platform/graphql:4.0.22composer require api-platform/graphql:3.4.17composer require api-platform/graphql:4.1.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0-alpha.1 | 4.0.22 | - |
| 0 | 3.4.17 | - |
| 4.1.0-alpha.1 | 4.1.5 | - |
Fixed versions
| 4.0.22 | 3.4.17 | 4.1.5 |
Sources
- osv: GHSA-428q-q3vv-3fq3
- https://github.com/api-platform/core/security/advisories/GHSA-428q-q3vv-3fq3
- https://nvd.nist.gov/vuln/detail/CVE-2025-31485
- https://github.com/api-platform/core/commit/7af65aad13037d7649348ee3dcd88e084ef771f8
- https://github.com/api-platform/core/commit/cba3acfbd517763cf320167250c5bed6d569696a
- https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/core/CVE-2025-31485.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/graphql/CVE-2025-31485.yaml
- https://github.com/api-platform/core
- https://github.com/api-platform/core/releases/tag/v3.4.17
CVE-2025-31485 · published · modified · JSON
Packagist/api-platform/core CVE-2025-31485: high 7.5
GraphQL grant on a property might be cached with different objects
Action: Upgrade api-platform/core to 3.4.17 or later.
composer require api-platform/core:4.0.22composer require api-platform/core:3.4.17composer require api-platform/core:4.1.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0-alpha.1 | 4.0.22 | - |
| 0 | 3.4.17 | - |
| 4.1.0-alpha.1 | 4.1.5 | - |
Fixed versions
| 4.0.22 | 3.4.17 | 4.1.5 |
Sources
- osv: GHSA-428q-q3vv-3fq3#Packagist/api-platform/core
- https://github.com/api-platform/core/security/advisories/GHSA-428q-q3vv-3fq3
- https://nvd.nist.gov/vuln/detail/CVE-2025-31485
- https://github.com/api-platform/core/commit/7af65aad13037d7649348ee3dcd88e084ef771f8
- https://github.com/api-platform/core/commit/cba3acfbd517763cf320167250c5bed6d569696a
- https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/core/CVE-2025-31485.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/graphql/CVE-2025-31485.yaml
- https://github.com/api-platform/core
- https://github.com/api-platform/core/releases/tag/v3.4.17
CVE-2025-31485 · published · modified · JSON