Craftql prior to version 1.3.7 contains a Server‑Side Request Forgery flaw that permits an attacker to force the application to issue requests to arbitrary internal or external addresses. The flaw is triggered via the GetAssetsFieldSchema.php listener, and the attacker can supply a crafted parameter that leads the server to resolve and request a chosen URL. This vulnerable behaviour can be abused to execute arbitrary code on the host, directly compromising confidentiality, integrity, and availability of the affected system.

The vulnerability affects all installations of Craftql 1.3.7 and earlier. The specific file involved is vendor/markhuot/craftql/src/Listeners/GetAssetsFieldSchema.php. No vendor product names are officially listed, but any deployment of the open‑source Craftql library within a PHP application is potentially impacted.

The flaw has a CVSS score of 7.5, indicating high impact, and an EPSS score of less than 1%, showing a low likelihood of exploitation. It is not listed in the CISA KEV catalog, but the existence of a publicly disclosed SSRF capable of arbitrary code execution remains a significant risk. Attackers who can access the vulnerable endpoint can craft a request that forces the application to request arbitrary URLs, potentially reaching internal services or cloud provider metadata endpoints if outbound traffic is not restricted.