CVE-2011-1144: PHP PEAR

Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The installer in PEAR 1.9.2 and earlier allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the (1) download_dir, (2) cache_dir, (3) tmp_dir, and (4) pear-build-download directories. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1072.

Affected products

• PHP PEAR: up to and including 1.9.2; version 0.2.2 only; version 0.9 only; version 0.10 only; version 0.11 only; version 0.90 only; …

Published 2011-03-03. Last modified 2026-06-16.