CVE-2019-16774
Object injection in cookie driver
CVE-2019-16774 is a medium vulnerability (CVSS 4.4) in Phpfastcache, published December 12, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.23%, the 68th percentile. Fixed in phpfastcache/phpfastcache 5.0.13.
In phpfastcache before 5.1.3, there is a possible object injection vulnerability in cookie driver.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Object injection in cookie driver
In phpfastcache before 5.1.3, there is a possible object injection vulnerability in cookie driver.
- Record
CVE-2019-16774- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2019-0775
In phpfastcache before 5.1.3, there is a possible object injection vulnerability in cookie driver.
- Record
EUVD-2019-0775- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-484f-743f-6jx2
Object injection in cookie driver in phpfastcache
Impact
An possible object injection has been discovered in cookie driver prior 5.0.13 versions (of 5.x releases).
Patches
The issue has been addressed by enforcing JSON conversion when deserializing
Workarounds
If you can't fix it, use another driver such as "Files" (Filesystem)
References
Fixing release: https://github.com/PHPSocialNetwork/phpfastcache/releases/tag/5.0.13
For more information
If you have any questions or comments about this advisory:
- Open an issue in the issue tracker
- Email us at [email protected]
- Record
GHSA-484f-743f-6jx2- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
In phpfastcache before 5.1.3, there is a possible object injection vulnerability in cookie driver.
- Record
CVE-2019-16774- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-94, CWE-502
- Updated
- 2026-11-02
OSV
In phpfastcache before 5.1.3, there is a possible object injection vulnerability in cookie driver.
- Record
CVE-2019-16774- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-484f-743f-6jx2
Object injection in cookie driver in phpfastcache
Impact
An possible object injection has been discovered in cookie driver prior 5.0.13 versions (of 5.x releases).
Patches
The issue has been addressed by enforcing JSON conversion when deserializing
Workarounds
If you can't fix it, use another driver such as "Files" (Filesystem)
References
Fixing release: https://github.com/PHPSocialNetwork/phpfastcache/releases/tag/5.0.13
For more information
If you have any questions or comments about this advisory:
- Open an issue in the issue tracker
- Email us at [email protected]
- Record
GHSA-484f-743f-6jx2- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpfastcache/phpfastcachePackagist |
5.0.0 up to 5.0.13 | 5.0.13 |
phpfastcache/phpfastcachePackagist |
5.0.0 up to 5.0.13, plus listed versions 5.0.15.0.105.0.115.0.125.0.2 Show 7 moreShow less5.0.35.0.45.0.55.0.65.0.75.0.85.0.9 |
5.0.13 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
github.com/PHPSocialNetwork/phpfastcache/security/advisories/GHSA-484f-743f-6jx2
nvd.nist.gov/vuln/detail/CVE-2019-16774