CVE-2026-31317 identifies an SSRF vulnerability in Craftql v1.3.7 and prior versions. The vulnerability resides in the GetAssetsFieldSchema.php listener file, enabling an attacker to execute arbitrary code by exploiting server-side request handling. No patch or official remediation level has been documented, and the vulnerability is not related to a cloud service. The CVE lacks a CVSS score, and no known active exploitation has been reported.

Successful exploitation of this SSRF vulnerability could allow an attacker to execute arbitrary code on the affected server, potentially leading to unauthorized access or control over the system. However, no known exploits are currently reported in the wild, and the extent of impact depends on the environment and usage of the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting network access to the affected service and monitor for unusual activity related to SSRF attempts. Avoid exposing the vulnerable component to untrusted inputs where possible.