CVE-2017-5630
High · 7.5CVSS
7.5
EPSS
12.5%
Published
Feb 1, 2017
CISA due date
—
The record
PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | pear/pear | 0 | No fix |
| Debian:10 | php-pear | 0 | No fix |
| Debian:11 | php-pear | 0 | No fix |
| Debian:12 | php-pear | 0 | No fix |
| Debian:13 | php-pear | 0 | No fix |
| Ubuntu:18.04:LTS | php-pear | 0 | No fix |
| Ubuntu:20.04:LTS | php-pear | 0 | No fix |
| Ubuntu:22.04:LTS | php-pear | 0 | No fix |
| Ubuntu:24.04:LTS | php-pear | 0 | No fix |
| Ubuntu:24.10 | php-pear | 0 | No fix |
| Ubuntu:25.04 | php-pear | 0 | No fix |
| Ubuntu:25.10 | php-pear | 0 | No fix |
| Ubuntu:Pro:14.04:LTS | php5 | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | php-pear | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | php-pear | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | php-pear | 0 | No fix |
| packagist | pear/pear | 1.10.1 | No fix |
Related vulnerabilities
- CVE-2018-1000888 PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in… Also affects php-pear
- CVE-2024-8926 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using… Also affects php5
- CVE-2015-9253 An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before… Also affects php5
- CVE-2017-12933 The finish_nested_data function in ext/standard/var_unserializer.re in PHP before 5.6.31… Also affects php5
- CVE-2017-8923 The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not… Also affects php5
- CVE-2026-114577 A vulnerability was found in oretnom23 php-travel-agency-system. CWE-74
- CVE-2026-114575 A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. CWE-74
- CVE-2026-112150 A security flaw has been discovered in vraj404 Criminal-Management-System up to… CWE-74