CVE-2011-1072: PHP PEAR

Low severity, CVSS 3.3. EPSS: 0.5% chance of exploitation in the next 30 days.

The installer in PEAR before 1.9.2 allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the (1) download_dir, (2) cache_dir, (3) tmp_dir, and (4) pear-build-download directories, a different vulnerability than CVE-2007-2519.

Affected products

• PHP PEAR: up to and including 1.9.1; version 0.2.2 only; version 0.9 only; version 0.10 only; version 0.11 only; version 0.90 only; …

Published 2011-03-03. Last modified 2026-06-16.