CVE-2021-37704: Exposed phpinfo() in PhpFastCache

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-08-12 · updated 2026-06-17
Weakness: CWE-200

Description

PhpFastCache is a high-performance backend cache system (packagist package phpfastcache/phpfastcache). In versions before 6.1.5, 7.1.2, and 8.0.7 the `phpinfo()` can be exposed if the `/vendor` is not protected from public access. This is a rare situation today since the vendor directory is often located outside the web directory or protected via server rule (.htaccess, etc). Only the v6, v7 and v8 will be patched respectively in 8.0.7, 7.1.2, 6.1.5. Older versions such as v5, v4 are not longer supported and will **NOT** be patched. As a workaround, protect the `/vendor` directory from public access.

Affected products

PHPSocialNetwork phpfastcache: before 6.1.5; from 7.0.0 before 7.1.2; from 8.0.0 before 8.0.7 — fixed in 6.1.5, 7.1.2, 8.0.7

How to fix

Upgrade to a fixed version: PHPSocialNetwork phpfastcache 6.1.5, 7.1.2, 8.0.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-37704 or the next vulnerability affects your stack