{"action":"Upgrade api-platform/graphql to 3.4.17 or later.","affected":[{"fixed":"4.0.22","introduced":"4.0.0-alpha.1"},{"fixed":"3.4.17","introduced":"0"},{"fixed":"4.1.5","introduced":"4.1.0-alpha.1"}],"component":"api-platform/graphql","cve_ids":["CVE-2025-31481"],"ecosystem":"Packagist","epss":0.00475,"exploited":false,"fixed_versions":["4.0.22","3.4.17","4.1.5"],"ghsa_id":"GHSA-cg3c-245w-728m","id":"tcs_01M5KF0XVH8JEH2F95NAN96EN9","modified_at":"2025-08-29T21:35:33.406512Z","published_at":"2025-04-04T14:07:20Z","references":["https://osv.dev/vulnerability/GHSA-cg3c-245w-728m","https://github.com/api-platform/core/security/advisories/GHSA-cg3c-245w-728m","https://nvd.nist.gov/vuln/detail/CVE-2025-31481","https://github.com/api-platform/core/commit/55712452b4f630978537bdb2a07dc958202336bb","https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568","https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/core/CVE-2025-31481.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/graphql/CVE-2025-31481.yaml","https://github.com/api-platform/core","https://github.com/api-platform/core/releases/tag/v3.4.17","https://github.com/api-platform/core/releases/tag/v4.1.5"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-cg3c-245w-728m","url":"https://osv.dev/vulnerability/GHSA-cg3c-245w-728m"}],"summary":"GraphQL query operations security can be bypassed"}