CVE-2017-5630
PEAR core file overwrite vulnerability
PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.
- Record
CVE-2017-5630- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-74
- Updated
- 2026-11-02
CVE List No score
PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.
- Record
CVE-2017-5630- Updated
- 2026-11-02
EUVDEUVD-2022-5878 No score
PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.
- Record
EUVD-2022-5878- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xxv8-pv43-57x5
PEAR core file overwrite vulnerability
PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.
- Record
GHSA-xxv8-pv43-57x5- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-74
- Updated
- 2026-11-02
OSV
PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.
- Record
CVE-2017-5630- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-5630
PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.
- Record
DEBIAN-CVE-2017-5630- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-xxv8-pv43-57x5
PEAR core file overwrite vulnerability
PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.
- Record
GHSA-xxv8-pv43-57x5- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-74
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-5630
PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.
- Record
UBUNTU-CVE-2017-5630- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pear/pearPackagist |
through 1.10.1 | None known |
php-pearDebian:12 |
All versions, plus listed versions 1:1.10.13+submodules+notgz+2022032202-21:1.10.16+submodules+notgz-11:1.10.16+submodules+notgz-21:1.10.16+submodules+notgz-3 |
None known |
php-pearDebian:13 |
All versions, plus listed versions 1:1.10.16+submodules+notgz-3 |
None known |
php-pearDebian:14 |
All versions, plus listed versions 1:1.10.16+submodules+notgz-3 |
None known |
php5Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 5.5.3+dfsg-1ubuntu25.5.3+dfsg-1ubuntu35.5.6+dfsg-1ubuntu15.5.6+dfsg-1ubuntu25.5.8+dfsg-2ubuntu1 Show 44 moreShow less5.5.9+dfsg-1ubuntu15.5.9+dfsg-1ubuntu25.5.9+dfsg-1ubuntu35.5.9+dfsg-1ubuntu45.5.9+dfsg-1ubuntu4.15.5.9+dfsg-1ubuntu4.25.5.9+dfsg-1ubuntu4.35.5.9+dfsg-1ubuntu4.45.5.9+dfsg-1ubuntu4.55.5.9+dfsg-1ubuntu4.65.5.9+dfsg-1ubuntu4.75.5.9+dfsg-1ubuntu4.95.5.9+dfsg-1ubuntu4.115.5.9+dfsg-1ubuntu4.125.5.9+dfsg-1ubuntu4.135.5.9+dfsg-1ubuntu4.145.5.9+dfsg-1ubuntu4.165.5.9+dfsg-1ubuntu4.175.5.9+dfsg-1ubuntu4.195.5.9+dfsg-1ubuntu4.205.5.9+dfsg-1ubuntu4.215.5.9+dfsg-1ubuntu4.225.5.9+dfsg-1ubuntu4.235.5.9+dfsg-1ubuntu4.245.5.9+dfsg-1ubuntu4.255.5.9+dfsg-1ubuntu4.265.5.9+dfsg-1ubuntu4.275.5.9+dfsg-1ubuntu4.295.5.9+dfsg-1ubuntu4.29+esm15.5.9+dfsg-1ubuntu4.29+esm25.5.9+dfsg-1ubuntu4.29+esm35.5.9+dfsg-1ubuntu4.29+esm45.5.9+dfsg-1ubuntu4.29+esm55.5.9+dfsg-1ubuntu4.29+esm65.5.9+dfsg-1ubuntu4.29+esm85.5.9+dfsg-1ubuntu4.29+esm105.5.9+dfsg-1ubuntu4.29+esm115.5.9+dfsg-1ubuntu4.29+esm125.5.9+dfsg-1ubuntu4.29+esm135.5.9+dfsg-1ubuntu4.29+esm145.5.9+dfsg-1ubuntu4.29+esm155.5.9+dfsg-1ubuntu4.29+esm165.5.9+dfsg-1ubuntu4.29+esm175.5.9+dfsg-1ubuntu4.29+esm18 |
None known |
php-pearUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1:1.10.1+submodules+notgz-41:1.10.1+submodules+notgz-61:1.10.1+submodules+notgz-6ubuntu0.11:1.10.1+submodules+notgz-6ubuntu0.21:1.10.1+submodules+notgz-6ubuntu0.31:1.10.1+submodules+notgz-6ubuntu0.3+esm1 |
None known |
php-pearUbuntu:18.04:LTS |
All versions, plus listed versions 1:1.10.5+submodules+notgz-11:1.10.5+submodules+notgz-1ubuntu11:1.10.5+submodules+notgz-1ubuntu1.18.04.11:1.10.5+submodules+notgz-1ubuntu1.18.04.21:1.10.5+submodules+notgz-1ubuntu1.18.04.31:1.10.5+submodules+notgz-1ubuntu1.18.04.4 |
None known |
php-pearUbuntu:20.04:LTS |
All versions, plus listed versions 1:1.10.9+submodules+notgz-11:1.10.9+submodules+notgz-1ubuntu0.20.04.11:1.10.9+submodules+notgz-1ubuntu0.20.04.21:1.10.9+submodules+notgz-1ubuntu0.20.04.3 |
None known |
php-pearUbuntu:22.04:LTS |
All versions, plus listed versions 1:1.10.12+submodules+notgz+20210212-1ubuntu11:1.10.12+submodules+notgz+20210212-1ubuntu3 |
None known |
php-pearUbuntu:24.04:LTS |
All versions, plus listed versions 1:1.10.13+submodules+notgz+2022032202-2build1 |
None known |
php-pearUbuntu:25.10 |
All versions, plus listed versions 1:1.10.13+submodules+notgz+2022032202-2build11:1.10.16+submodules+notgz-3 |
None known |
php-pearUbuntu:26.10 |
All versions, plus listed versions 1:1.10.16+submodules+notgz-3ubuntu1 |
None known |
php-pearUbuntu:26.04:LTS |
All versions, plus listed versions 1:1.10.16+submodules+notgz-31:1.10.16+submodules+notgz-3build11:1.10.16+submodules+notgz-3ubuntu1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | PHP PEAR 1.10.1 - Arbitrary File Download | 2017-01-30 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-5630 is a high vulnerability (CVSS 7.5) in Php Pear, published February 1, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 12.5%, the 96th percentile. No source names a fixed version.