Object injection in cookie driver in phpfastcache

CRITIQUE 9.8CVE-2019-16774 · GHSA-484f-743f-6jx2 · Published 12/12/2019 · updated 17/06/2026

En bref

CVE-2019-16774 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant phpfastcache/phpfastcache, phpfastcache (phpfastcache).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.2%, plus élevée que 69.0% des vulnérabilités.
Correctif : mettre à jour vers 5.0.13 ou plus récent.

Package	Affected versions	Patched versions
phpfastcache/phpfastcache Packagist	`≥ 5.0.0, < 5.0.13`	`5.0.13`
phpfastcache phpfastcache	`< 5.0.13`	`5.0.13`

An possible object injection has been discovered in cookie driver prior 5.0.13 versions (of 5.x releases).

The issue has been addressed by enforcing JSON conversion when deserializing

If you can't fix it, use another driver such as "Files" (Filesystem)

If you have any questions or comments about this advisory:

NVD description

In phpfastcache before 5.1.3, there is a possible object injection vulnerability in cookie driver.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Packagist

≥ 5.0.0, < 5.0.13

5.0.13

< 5.0.13