Which products and versions are affected by CVE-2021-37704?

Affected: Phpfastcache versions >= = 8.0.0. The full list is in the CVE brief.

Is CVE-2021-37704 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2021-37704 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2021-37704?

No public exploit code is known.

Is there a fix for CVE-2021-37704?

Fixed versions are available, including Phpfastcache 6.1.5, phpfastcache/phpfastcache 6.1.5, phpfastcache/phpfastcache 7.1.2.

How urgently should CVE-2021-37704 be patched?

Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.

Request A Demo

Vulnerability Intelligence

CVE-2021-37704

Medium

Exposed phpinfo() leadked via documentation files

Published Aug 30, 2021 · Updated Sep 10, 2026 · Also known as GHSA-cvh5-p6r6-g2qc

Key Facts

Routine patching

CVE-2021-37704 is a medium-severity vulnerability (CVSS 4.3 v3.1) affecting Phpfastcache, phpfastcache/phpfastcache (composer).
It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
EPSS estimates a 5.9% probability of exploitation in the next 30 days.
Fixed versions are available, including Phpfastcache 6.1.5, phpfastcache/phpfastcache 6.1.5, phpfastcache/phpfastcache 7.1.2.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.

CVSS v3.1

4.3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS (30-day exploit likelihood)

5.9%

Higher than 93.1% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2021-37704 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

PhpFastCache is a high-performance backend cache system (packagist package phpfastcache/phpfastcache). In versions before 6.1.5, 7.1.2, and 8.0.7 the phpinfo() can be exposed if the /vendor is not protected from public access. This is a rare situation today since the vendor directory is often located outside the web directory or protected via server rule (.htaccess, etc). Only the v6, v7 and v8 will be patched respectively in 8.0.7, 7.1.2, 6.1.5. Older versions such as v5, v4 are not longer supported and will NOT be patched. As a workaround, protect the /vendor directory from public access.

Affected Products

3 affected entries in total

Product	Affected versions	Fixed in
PhpfastcachePhpfastcache	>= < 6.1.5	6.1.5
phpfastcache/phpfastcachecomposer	>= 8.0.0	8.0.7

Patched Releases

Phpfastcache

6.1.5

phpfastcache/phpfastcache

6.1.5, 7.1.2, 8.0.7

Timeline

Publicly disclosed
Aug 30, 2021
Last updated
Sep 10, 2026

Weakness Type

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-668 Exposure of Resource to Wrong Sphere

References

5 more references in the full CVE brief

FAQ

Common Questions.

PhpFastCache is a high-performance backend cache system (packagist package phpfastcache/phpfastcache).
Affected: Phpfastcache versions >= < 6.1.5; phpfastcache/phpfastcache (composer) versions >= 8.0.0. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Phpfastcache 6.1.5, phpfastcache/phpfastcache 6.1.5, phpfastcache/phpfastcache 7.1.2.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.

Is CVE-2021-37704 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.