Exposed phpinfo() in PhpFastCache
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
PhpFastCache is a high-performance backend cache system (packagist package phpfastcache/phpfastcache). In versions before 6.1.5, 7.1.2, and 8.0.7 the `phpinfo()` can be exposed if the `/vendor` is not protected from public access. This is a rare situation today since the vendor directory is often located outside the web directory or protected via server rule (.htaccess, etc). Only the v6, v7 and v8 will be patched respectively in 8.0.7, 7.1.2, 6.1.5. Older versions such as v5, v4 are not longer supported and will **NOT** be patched. As a workaround, protect the `/vendor` directory from public access.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| PHPSocialNetwork | phpfastcache | before 6.1.5; 7.0.0 to before 7.1.2; 8.0.0 to before 8.0.7 | 6.1.5, 7.1.2, 8.0.7 | Patch available | CNA |
| — | phpfastcache/phpfastcache (Packagist) | before 6.1.5 | 6.1.5 | Patch available | GHSA-cvh5-p6r6-g2qc |
| — | phpfastcache/phpfastcache (Packagist) | 7.0.0 to before 7.1.2 | 7.1.2 | Patch available | GHSA-cvh5-p6r6-g2qc |
| — | phpfastcache/phpfastcache (Packagist) | 8.0.0 to before 8.0.7 | 8.0.7 | Patch available | GHSA-cvh5-p6r6-g2qc |
- phpfastcache VendorPHPSocialNetwork Affected before 6.1.5; 7.0.0 to before 7.1.2; 8.0.0 to before 8.0.7 Fixed in 6.1.5, 7.1.2, 8.0.7 Patch available CNA
- phpfastcache/phpfastcache (Packagist) Vendor— Affected before 6.1.5 Fixed in 6.1.5 Patch available GHSA-cvh5-p6r6-g2qc
- phpfastcache/phpfastcache (Packagist) Vendor— Affected 7.0.0 to before 7.1.2 Fixed in 7.1.2 Patch available GHSA-cvh5-p6r6-g2qc
- phpfastcache/phpfastcache (Packagist) Vendor— Affected 8.0.0 to before 8.0.7 Fixed in 8.0.7 Patch available GHSA-cvh5-p6r6-g2qc
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:phpfastcache:phpfastcache:*:*:*:*:*:*:*:* | before 6.1.5; 7.0.0 to before 7.1.2; 8.0.0 to before 8.0.7 | Vulnerable | Phpfastcache |
- cpe:2.3:a:phpfastcache:phpfastcache:*:*:*:*:*:*:*:* Versions before 6.1.5; 7.0.0 to before 7.1.2; 8.0.0 to before 8.0.7 Vulnerable ·Phpfastcache
Remediation
- Fix · CNA phpfastcache (PHPSocialNetwork) Fixed in 6.1.5, 7.1.2, 8.0.7
- Fix · GHSA-cvh5-p6r6-g2qc phpfastcache/phpfastcache (Packagist) Fixed in 6.1.5 Advisory →
- Fix · GHSA-cvh5-p6r6-g2qc phpfastcache/phpfastcache (Packagist) Fixed in 7.1.2 Advisory →
- Fix · GHSA-cvh5-p6r6-g2qc phpfastcache/phpfastcache (Packagist) Fixed in 8.0.7 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-37704
- 2026-10-03 Alias added: GHSA-cvh5-p6r6-g2qc
References
Patch 2
Advisory 6
- https://github.com/PHPSocialNetwork/phpfastcache/security/advisories/GHSA-cvh5-p6r6-g2qc
- https://github.com/PHPSocialNetwork/phpfastcache/pull/814
- https://github.com/PHPSocialNetwork/phpfastcache/pull/815
- https://github.com/PHPSocialNetwork/phpfastcache/blob/master/CHANGELOG.md#807
- https://packagist.org/packages/phpfastcache/phpfastcache
- https://nvd.nist.gov/vuln/detail/CVE-2021-37704
More Phpfastcache vulnerabilities
- TI-2019-12554 Object injection in cookie driver CVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-37704 · CVE Program
- CVE-2021-37704 · NVD
- FIRST EPSS
- GHSA-cvh5-p6r6-g2qc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences