CVE-2005-4154: PHP PEAR

Medium severity, CVSS 5.1. EPSS: 7.4% chance of exploitation in the next 30 days.

Unspecified vulnerability in PEAR installer 1.4.2 and earlier allows user-assisted attackers to execute arbitrary code via a crafted package that can execute code when the pear command is executed or when the Web/Gtk frontend is loaded.

Affected products

• PHP PEAR: up to and including 1.4.2; version 0.9 only; version 0.10 only; version 0.11 only; version 0.90 only; version 1.0 only; …

Published 2005-12-11. Last modified 2026-06-16.