Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/api-platform/core@2.2.10
purl pkg:composer/api-platform/core@2.2.10
Next non-vulnerable version 3.4.17
Latest non-vulnerable version 4.1.5
Risk 4.0
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-ezka-28sk-rbaz
Aliases:
CVE-2025-31481
GHSA-cg3c-245w-728m
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an operation. This vulnerability is fixed in 4.0.22 and 3.4.17.
3.4.17
Affected by 0 other vulnerabilities.
4.0.22
Affected by 0 other vulnerabilities.
4.1.5
Affected by 0 other vulnerabilities.
VCID-h6xs-dtvv-mffa
Aliases:
CVE-2025-31485
GHSA-428q-q3vv-3fq3
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL grant on a property might be cached with different objects. The ApiPlatform\GraphQl\Serializer\ItemNormalizer::isCacheKeySafe() method is meant to prevent the caching but the parent::normalize method that is called afterwards still creates the cache key and causes the issue. This vulnerability is fixed in 4.0.22 and 3.4.17.
3.4.17
Affected by 0 other vulnerabilities.
4.0.22
Affected by 0 other vulnerabilities.
4.1.5
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-a2jr-a4gk-7fdz Incorrect Access Control vulnerability in api-platform/core CVE-2019-1000011
GHSA-974j-wjxx-wggj

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-12T19:58:12.045873+00:00 GitLab Importer Affected by VCID-h6xs-dtvv-mffa https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/api-platform/core/CVE-2025-31485.yml 38.6.0
2026-06-12T19:58:09.939860+00:00 GitLab Importer Affected by VCID-ezka-28sk-rbaz https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/api-platform/core/CVE-2025-31481.yml 38.6.0
2026-06-12T15:41:27.812269+00:00 GitLab Importer Fixing VCID-a2jr-a4gk-7fdz https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/api-platform/core/CVE-2019-1000011.yml 38.6.0
2026-06-12T08:10:32.487759+00:00 GithubOSV Importer Fixing VCID-a2jr-a4gk-7fdz https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/10/GHSA-974j-wjxx-wggj/GHSA-974j-wjxx-wggj.json 38.6.0
2026-06-11T20:25:33.830130+00:00 GHSA Importer Fixing VCID-a2jr-a4gk-7fdz https://github.com/advisories/GHSA-974j-wjxx-wggj 38.6.0