Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/api-platform/core@3.2.5
purl pkg:composer/api-platform/core@3.2.5
Next non-vulnerable version 3.4.17
Latest non-vulnerable version 4.1.5
Risk 4.0
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-ezka-28sk-rbaz
Aliases:
CVE-2025-31481
GHSA-cg3c-245w-728m
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an operation. This vulnerability is fixed in 4.0.22 and 3.4.17.
3.4.17
Affected by 0 other vulnerabilities.
4.0.22
Affected by 0 other vulnerabilities.
4.1.5
Affected by 0 other vulnerabilities.
VCID-h6xs-dtvv-mffa
Aliases:
CVE-2025-31485
GHSA-428q-q3vv-3fq3
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL grant on a property might be cached with different objects. The ApiPlatform\GraphQl\Serializer\ItemNormalizer::isCacheKeySafe() method is meant to prevent the caching but the parent::normalize method that is called afterwards still creates the cache key and causes the issue. This vulnerability is fixed in 4.0.22 and 3.4.17.
3.4.17
Affected by 0 other vulnerabilities.
4.0.22
Affected by 0 other vulnerabilities.
4.1.5
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-e6gt-66gm-yqbb API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. From 3.2.0 until 3.2.4, exception messages, that are not HTTP exceptions, are visible in the JSON error response. This vulnerability is fixed in 3.2.5. CVE-2023-47639
GHSA-rfw5-cqjj-7v9r

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-15T01:55:11.520241+00:00 GHSA Importer Fixing VCID-e6gt-66gm-yqbb https://github.com/advisories/GHSA-rfw5-cqjj-7v9r 38.6.0
2026-06-12T19:58:12.590047+00:00 GitLab Importer Affected by VCID-h6xs-dtvv-mffa https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/api-platform/core/CVE-2025-31485.yml 38.6.0
2026-06-12T19:58:10.550293+00:00 GitLab Importer Affected by VCID-ezka-28sk-rbaz https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/api-platform/core/CVE-2025-31481.yml 38.6.0
2026-06-12T19:58:05.070159+00:00 GitLab Importer Fixing VCID-e6gt-66gm-yqbb https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/api-platform/core/CVE-2023-47639.yml 38.6.0
2026-06-12T07:52:47.202714+00:00 GithubOSV Importer Fixing VCID-e6gt-66gm-yqbb https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-rfw5-cqjj-7v9r/GHSA-rfw5-cqjj-7v9r.json 38.6.0