Craft CMS SQL injection vulnerability via the GraphQL API endpoint

CRITICAL 9.8CVE-2024-37843 · GHSA-hq4f-mv3q-8wcv · Published 25/06/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
craftcms/cms Packagist	`≤ 3.7.31`	No fix yet
craft cms craftcms	`< 3.7.31`	`3.7.31`

Description

Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.

NVD description

Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.