CVE-2017-5630

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 12.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-02-01 · updated 2026-06-17
Weakness: CWE-74

Description

PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.

Affected products

php Pear: 1.10.1

References

http://pear.php.net/bugs/bug.php?id=21171
http://www.securityfocus.com/bid/95882
https://www.exploit-db.com/exploits/41185/
http://pear.php.net/bugs/bug.php?id=21171
http://www.securityfocus.com/bid/95882
https://www.exploit-db.com/exploits/41185/

Get alerted when CVE-2017-5630 or the next vulnerability affects your stack