CVE-2011-1144

no score yetEPSS 0.3%

php pear: no CVSS score yet. EPSS 0.3% chance of exploitation in the next 30 days.

The installer in PEAR 1.9.2 and earlier allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the (1) download_dir, (2) cache_dir, (3) tmp_dir, and (4) pear-build-download directories. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1072.

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-11-01)
CWE: CWE-59
Published: 2011-03-03
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

php:pear

References

http://openwall.com/lists/oss-security/2011/02/28/5
http://openwall.com/lists/oss-security/2011/03/01/4
http://openwall.com/lists/oss-security/2011/03/01/5
http://openwall.com/lists/oss-security/2011/03/01/7
http://openwall.com/lists/oss-security/2011/03/01/8

Check your stack JSON