CVE-2023-47639: API Platform Core can leak exceptions message that may contain sensitive information

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-03 · updated 2026-06-17
Weakness: CWE-209

Description

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. From 3.2.0 until 3.2.4, exception messages, that are not HTTP exceptions, are visible in the JSON error response. This vulnerability is fixed in 3.2.5.

Affected products

api-platform core: from 3.2.0, < 3.2.5

References

https://github.com/api-platform/core/commit/ba8a7e6538bccebf14c228e43a9339214c4d9201
https://github.com/api-platform/core/pull/5823
https://github.com/api-platform/core/security/advisories/GHSA-rfw5-cqjj-7v9r

Get alerted when CVE-2023-47639 or the next vulnerability affects your stack