GHSA-xxv8-pv43-57x5HighCVSS 7.5

PEAR core file overwrite vulnerability

Published
May 13, 2022
Last Modified
July 7, 2023

🔗 CVE IDs covered (1)

CVE-2017-5630 →

📋 Description

PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.

🎯 Affected products1

  • composer/pear/pear:<= 1.10.1

🔗 References (7)