CVE-2026-31317 identifies an SSRF vulnerability in Craftql v1.3.7 and earlier, specifically in the GetAssetsFieldSchema.php listener file. This flaw permits remote attackers to trigger server-side requests that can result in arbitrary code execution without requiring authentication. The vulnerability is rated with a CVSS 3.1 base score of 7.5 (high severity), reflecting its network attack vector, low attack complexity, no privileges required, and high confidentiality impact. No vendor advisory or patch information is currently provided, and no active exploitation has been reported.

An attacker exploiting this SSRF vulnerability could execute arbitrary code on the affected server, compromising confidentiality. The vulnerability does not impact integrity or availability according to the CVSS vector. Since no known exploits are reported, the immediate risk may be limited, but the potential for serious impact exists if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting network access to the vulnerable component and monitor for suspicious activity related to SSRF attempts. Avoid exposing the vulnerable service to untrusted networks.