Description
Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | doctrine | 2.4.8-1 | — |
| Debian 14 | php-doctrine-annotations | 1.2.7-1 | — |
| Debian 14 | php-doctrine-cache | 1.4.2-1 | — |
| Debian 13 | doctrine | 2.4.8-1 | — |
| Debian 13 | php-doctrine-annotations | 1.2.7-1 | — |
| Debian 13 | php-doctrine-cache | 1.4.2-1 | — |
| Debian 13 | php-doctrine-common | 2.4.3-1 | — |
| Debian 12 | doctrine | 2.4.8-1 | — |
| Debian 12 | php-doctrine-annotations | 1.2.7-1 | — |
| Debian 12 | php-doctrine-cache | 1.4.2-1 | — |
| Debian 12 | php-doctrine-common | 2.4.3-1 | — |
| Debian 8 | zendframework | 1.12.9+dfsg-2+deb8u4 | DSA-3369-1 |
| Debian 7 | zendframework | 1.11.13-1.1+deb7u4 | DSA-3369-1 |
Affected packages
Advisories 1
- DSA-3369-1 zendframework - security update Debian Security (DSA / DLA) · Mar 9, 2026