CVE-2017-5630

—

CVSS 3.1

7.5 high

EPSS

13%p96

Published

Feb 1, 2017 (Feb 1, 2017)

Modified

Jun 17, 2026

Description

PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.

Vendors: php
Products: pear
Weakness: CWE-74
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (12.5%)

In the news0 stories

No ingested article mentions this CVE yet.