CVE-2025-31485 json
GraphQL grant on a property might be cached with different objects
published 2025-04-03 19 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-9735 , GHSA-428q-q3vv-3fq3
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 50%
- public exploits
- 0
- none known
Summary
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL grant on a property might be cached with different objects. The ApiPlatform\GraphQl\Serializer\ItemNormalizer::isCacheKeySafe() method is meant to prevent the caching but the parent::normalize method that is called afterwards still creates the cache key and causes the issue. This vulnerability is fixed in 4.0.22 and 3.4.17.
Patch / fix
- packagist api-platform/graphql 3.4.17, 4.0.22, 4.1.5
- packagist api-platform/core 3.4.17, 4.0.22, 4.1.5
- api-platform core 3.4.17, 4.0.22
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
0.63% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | api-platform/graphql | >=4.0.0-alpha.1, <4.0.22 <3.4.17 >=4.1.0-alpha.1, <4.1.5 |
4.0.22 3.4.17 4.1.5 |
| packagist | api-platform/core | >=4.0.0-alpha.1, <4.0.22 <3.4.17 >=4.1.0-alpha.1, <4.1.5 |
4.0.22 3.4.17 4.1.5 |
Affected products
- api-platform core
Classification
- Weakness
-
- CWE-696 Incorrect Behavior Order
References
-
github.com
/api-platform/core/commit/7af65aad13037d7649348ee3dcd88e084ef771f8
web
-
github.com
/api-platform/core/commit/cba3acfbd517763cf320167250c5bed6d569696a
web
-
github.com
/api-platform/core/security/advisories/GHSA-428q-q3vv-3fq3
web
-
github.com
/api-platform/core/releases/tag/v3.4.17
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-31485
advisory
-
github.com
/FriendsOfPHP/security-advisories/blob/master/api-platform/core/CVE-2025-31485.yaml
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/api-platform/graphql/CVE-2025-31485.yaml
web
-
github.com
/api-platform/core
package
Sources
- CVE List CVE-2025-31485
- GitHub Advisory GHSA-428q-q3vv-3fq3
- NVD CVE-2025-31485
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.