{"id":"CVE-2017-5630","aliases":["DEBIAN-CVE-2017-5630","EUVD-2022-5878","GHSA-xxv8-pv43-57x5","UBUNTU-CVE-2017-5630"],"status":"published","title":"PEAR core file overwrite vulnerability","description":"PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.12513,"percentile":0.96255,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-74"],"published":"2017-02-01T23:00:00Z","modified":"2026-10-21T23:00:13Z","exploits":[{"source":"exploitdb","id":"EDB-41185","title":"PHP PEAR 1.10.1 - Arbitrary File Download","type":"webapps","platform":"php","date":"2017-01-30","url":"https://www.exploit-db.com/exploits/41185"}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"pear/pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.10.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.10.13+submodules+notgz+2022032202-2","1:1.10.16+submodules+notgz-1","1:1.10.16+submodules+notgz-2","1:1.10.16+submodules+notgz-3"]},{"source":"osv","ecosystem":"Debian:13","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.10.16+submodules+notgz-3"]},{"source":"osv","ecosystem":"Debian:14","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.10.16+submodules+notgz-3"]},{"source":"osv","ecosystem":"Packagist","package":"pear/pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.10.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.5.3+dfsg-1ubuntu2","5.5.3+dfsg-1ubuntu3","5.5.6+dfsg-1ubuntu1","5.5.6+dfsg-1ubuntu2","5.5.8+dfsg-2ubuntu1","5.5.9+dfsg-1ubuntu1","5.5.9+dfsg-1ubuntu2","5.5.9+dfsg-1ubuntu3","5.5.9+dfsg-1ubuntu4","5.5.9+dfsg-1ubuntu4.1","5.5.9+dfsg-1ubuntu4.2","5.5.9+dfsg-1ubuntu4.3","5.5.9+dfsg-1ubuntu4.4","5.5.9+dfsg-1ubuntu4.5","5.5.9+dfsg-1ubuntu4.6","5.5.9+dfsg-1ubuntu4.7","5.5.9+dfsg-1ubuntu4.9","5.5.9+dfsg-1ubuntu4.11","5.5.9+dfsg-1ubuntu4.12","5.5.9+dfsg-1ubuntu4.13","5.5.9+dfsg-1ubuntu4.14","5.5.9+dfsg-1ubuntu4.16","5.5.9+dfsg-1ubuntu4.17","5.5.9+dfsg-1ubuntu4.19","5.5.9+dfsg-1ubuntu4.20","5.5.9+dfsg-1ubuntu4.21","5.5.9+dfsg-1ubuntu4.22","5.5.9+dfsg-1ubuntu4.23","5.5.9+dfsg-1ubuntu4.24","5.5.9+dfsg-1ubuntu4.25","5.5.9+dfsg-1ubuntu4.26","5.5.9+dfsg-1ubuntu4.27","5.5.9+dfsg-1ubuntu4.29","5.5.9+dfsg-1ubuntu4.29+esm1","5.5.9+dfsg-1ubuntu4.29+esm2","5.5.9+dfsg-1ubuntu4.29+esm3","5.5.9+dfsg-1ubuntu4.29+esm4","5.5.9+dfsg-1ubuntu4.29+esm5","5.5.9+dfsg-1ubuntu4.29+esm6","5.5.9+dfsg-1ubuntu4.29+esm8","5.5.9+dfsg-1ubuntu4.29+esm10","5.5.9+dfsg-1ubuntu4.29+esm11","5.5.9+dfsg-1ubuntu4.29+esm12","5.5.9+dfsg-1ubuntu4.29+esm13","5.5.9+dfsg-1ubuntu4.29+esm14","5.5.9+dfsg-1ubuntu4.29+esm15","5.5.9+dfsg-1ubuntu4.29+esm16","5.5.9+dfsg-1ubuntu4.29+esm17","5.5.9+dfsg-1ubuntu4.29+esm18"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.10.1+submodules+notgz-4","1:1.10.1+submodules+notgz-6","1:1.10.1+submodules+notgz-6ubuntu0.1","1:1.10.1+submodules+notgz-6ubuntu0.2","1:1.10.1+submodules+notgz-6ubuntu0.3","1:1.10.1+submodules+notgz-6ubuntu0.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.10.5+submodules+notgz-1","1:1.10.5+submodules+notgz-1ubuntu1","1:1.10.5+submodules+notgz-1ubuntu1.18.04.1","1:1.10.5+submodules+notgz-1ubuntu1.18.04.2","1:1.10.5+submodules+notgz-1ubuntu1.18.04.3","1:1.10.5+submodules+notgz-1ubuntu1.18.04.4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.10.9+submodules+notgz-1","1:1.10.9+submodules+notgz-1ubuntu0.20.04.1","1:1.10.9+submodules+notgz-1ubuntu0.20.04.2","1:1.10.9+submodules+notgz-1ubuntu0.20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.10.12+submodules+notgz+20210212-1ubuntu1","1:1.10.12+submodules+notgz+20210212-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.10.13+submodules+notgz+2022032202-2build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.10.13+submodules+notgz+2022032202-2build1","1:1.10.16+submodules+notgz-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.10.16+submodules+notgz-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.10.16+submodules+notgz-3","1:1.10.16+submodules+notgz-3build1","1:1.10.16+submodules+notgz-3ubuntu1"]}],"products":[{"vendor":"php","product":"pear"}],"references":[{"url":"https://www.exploit-db.com/exploits/41185/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.securityfocus.com/bid/95882","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://pear.php.net/bugs/bug.php?id=21171","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5630","tags":["advisory"]},{"url":"https://vimeo.com/201341280","tags":["web"]},{"url":"https://web.archive.org/web/20210123222048/https://www.securityfocus.com/bid/95882/"},{"url":"http://hyp3rlinx.altervista.org/advisories/PEAR-ARBITRARY-FILE-DOWNLOAD.txt","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xxv8-pv43-57x5"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-5630","tags":["advisory"]},{"url":"https://github.com/pear/pear-core","tags":["package"]},{"url":"https://web.archive.org/web/20210123222048/https://www.securityfocus.com/bid/95882","tags":["web"]},{"url":"https://www.exploit-db.com/exploits/41185","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-5630","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5630","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-5630","description":"PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.","status":"published","published":"2017-02-01T23:00:00Z","modified":"2024-08-05T15:04:15.355Z","updated_at":"2026-11-02T14:33:12.942409Z"}],"euvd":[{"id":"EUVD-2022-5878","description":"PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.","status":"published","published":"2017-02-01T23:00:00Z","modified":"2024-08-05T15:04:15Z","updated_at":"2026-11-03T02:39:14.545495Z"}],"ghsa":[{"id":"GHSA-xxv8-pv43-57x5","title":"PEAR core file overwrite vulnerability","description":"PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.","status":"published","published":"2022-05-13T01:28:45Z","modified":"2023-07-07T20:58:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:36:56.605555Z"}],"nvd":[{"id":"CVE-2017-5630","description":"PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.","status":"published","published":"2017-02-01T23:59:00.137Z","modified":"2026-06-17T01:20:52.95Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:03:42.372487Z"}],"osv":[{"id":"CVE-2017-5630","description":"PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.","status":"published","published":"2017-02-01T23:59:00.137Z","modified":"2026-03-15T22:16:24.75151Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:06.029968Z"},{"id":"DEBIAN-CVE-2017-5630","description":"PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.","status":"published","published":"2017-02-01T23:59:00.137Z","modified":"2026-09-01T20:03:48.591361117Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:29.412243Z"},{"id":"GHSA-xxv8-pv43-57x5","title":"PEAR core file overwrite vulnerability","description":"PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.","status":"published","published":"2022-05-13T01:28:45Z","modified":"2023-11-08T03:59:22.059808Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"UBUNTU-CVE-2017-5630","description":"PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.","status":"published","published":"2017-02-01T23:59:00Z","modified":"2026-10-21T23:00:13.906530657Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:15.388065Z"}]}}