Read the docs
TI-2007-02431 Aliases CVE-2007-2519GHSA-w4p3-mf5w-2mr6

Directory traversal vulnerability in the installer in PEAR 1.0 through 1.5.3 allows…

Priority MEDIUM 40Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Directory traversal vulnerability in the installer in PEAR 1.0 through 1.5.3 allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in the (1) install-as attribute in the file element in package.xml 1.0 or the (2) as attribute in the install element in package.xml 2.0. NOTE: it could be argued that this does not cross privilege boundaries in typical installations, since the code being installed could perform the same actions.

Why it matters now

EPSS 0.07656 94th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 59

CPEVersionsRoleVendor
cpe:2.3:a:php_group:pear:1.0:*:*:*:*:*:*:*1.0VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.0.1:*:*:*:*:*:*:*1.0.1VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.1:*:*:*:*:*:*:*1.1VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.2:*:*:*:*:*:*:*1.2VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.2.1:*:*:*:*:*:*:*1.2.1VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.2b1:*:*:*:*:*:*:*1.2b1VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.2b2:*:*:*:*:*:*:*1.2b2VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.2b3:*:*:*:*:*:*:*1.2b3VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.2b4:*:*:*:*:*:*:*1.2b4VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.2b5:*:*:*:*:*:*:*1.2b5VulnerablePHP Group
  • cpe:2.3:a:php_group:pear:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.2b1:*:*:*:*:*:*:* Versions 1.2b1 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.2b2:*:*:*:*:*:*:* Versions 1.2b2 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.2b3:*:*:*:*:*:*:* Versions 1.2b3 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.2b4:*:*:*:*:*:*:* Versions 1.2b4 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.2b5:*:*:*:*:*:*:* Versions 1.2b5 Vulnerable ·PHP Group
Show 49 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:php_group:pear:1.3:*:*:*:*:*:*:*1.3VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.3.1:*:*:*:*:*:*:*1.3.1VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.3.3:*:*:*:*:*:*:*1.3.3VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.3.3.1:*:*:*:*:*:*:*1.3.3.1VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.3.4:*:*:*:*:*:*:*1.3.4VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.3.5:*:*:*:*:*:*:*1.3.5VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.3.6:*:*:*:*:*:*:*1.3.6VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.3b1:*:*:*:*:*:*:*1.3b1VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.3b2:*:*:*:*:*:*:*1.3b2VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.3b3:*:*:*:*:*:*:*1.3b3VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.3b5:*:*:*:*:*:*:*1.3b5VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.3b6:*:*:*:*:*:*:*1.3b6VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.0:*:*:*:*:*:*:*1.4.0VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.0a1:*:*:*:*:*:*:*1.4.0a1VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.0a2:*:*:*:*:*:*:*1.4.0a2VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.0a3:*:*:*:*:*:*:*1.4.0a3VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.0a4:*:*:*:*:*:*:*1.4.0a4VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.0a5:*:*:*:*:*:*:*1.4.0a5VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.0a6:*:*:*:*:*:*:*1.4.0a6VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.0a7:*:*:*:*:*:*:*1.4.0a7VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.0a8:*:*:*:*:*:*:*1.4.0a8VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.0a9:*:*:*:*:*:*:*1.4.0a9VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.0a10:*:*:*:*:*:*:*1.4.0a10VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.0a11:*:*:*:*:*:*:*1.4.0a11VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.0a12:*:*:*:*:*:*:*1.4.0a12VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.0b1:*:*:*:*:*:*:*1.4.0b1VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.0b2:*:*:*:*:*:*:*1.4.0b2VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.0rc1:*:*:*:*:*:*:*1.4.0rc1VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.0rc2:*:*:*:*:*:*:*1.4.0rc2VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.1:*:*:*:*:*:*:*1.4.1VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.2:*:*:*:*:*:*:*1.4.2VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.3:*:*:*:*:*:*:*1.4.3VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.4:*:*:*:*:*:*:*1.4.4VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.5:*:*:*:*:*:*:*1.4.5VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.6:*:*:*:*:*:*:*1.4.6VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.7:*:*:*:*:*:*:*1.4.7VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.8:*:*:*:*:*:*:*1.4.8VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.9:*:*:*:*:*:*:*1.4.9VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.10:*:*:*:*:*:*:*1.4.10VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.10rc1:*:*:*:*:*:*:*1.4.10rc1VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.4.11:*:*:*:*:*:*:*1.4.11VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.5.0:*:*:*:*:*:*:*1.5.0VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.5.0a1:*:*:*:*:*:*:*1.5.0a1VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.5.0rc1:*:*:*:*:*:*:*1.5.0rc1VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.5.0rc2:*:*:*:*:*:*:*1.5.0rc2VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.5.0rc3:*:*:*:*:*:*:*1.5.0rc3VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.5.1:*:*:*:*:*:*:*1.5.1VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.5.2:*:*:*:*:*:*:*1.5.2VulnerablePHP Group
cpe:2.3:a:php_group:pear:1.5.3:*:*:*:*:*:*:*1.5.3VulnerablePHP Group
  • cpe:2.3:a:php_group:pear:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.3.1:*:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.3.3:*:*:*:*:*:*:* Versions 1.3.3 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.3.3.1:*:*:*:*:*:*:* Versions 1.3.3.1 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.3.4:*:*:*:*:*:*:* Versions 1.3.4 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.3.5:*:*:*:*:*:*:* Versions 1.3.5 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.3.6:*:*:*:*:*:*:* Versions 1.3.6 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.3b1:*:*:*:*:*:*:* Versions 1.3b1 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.3b2:*:*:*:*:*:*:* Versions 1.3b2 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.3b3:*:*:*:*:*:*:* Versions 1.3b3 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.3b5:*:*:*:*:*:*:* Versions 1.3b5 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.3b6:*:*:*:*:*:*:* Versions 1.3b6 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.0a1:*:*:*:*:*:*:* Versions 1.4.0a1 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.0a2:*:*:*:*:*:*:* Versions 1.4.0a2 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.0a3:*:*:*:*:*:*:* Versions 1.4.0a3 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.0a4:*:*:*:*:*:*:* Versions 1.4.0a4 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.0a5:*:*:*:*:*:*:* Versions 1.4.0a5 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.0a6:*:*:*:*:*:*:* Versions 1.4.0a6 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.0a7:*:*:*:*:*:*:* Versions 1.4.0a7 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.0a8:*:*:*:*:*:*:* Versions 1.4.0a8 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.0a9:*:*:*:*:*:*:* Versions 1.4.0a9 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.0a10:*:*:*:*:*:*:* Versions 1.4.0a10 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.0a11:*:*:*:*:*:*:* Versions 1.4.0a11 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.0a12:*:*:*:*:*:*:* Versions 1.4.0a12 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.0b1:*:*:*:*:*:*:* Versions 1.4.0b1 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.0b2:*:*:*:*:*:*:* Versions 1.4.0b2 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.0rc1:*:*:*:*:*:*:* Versions 1.4.0rc1 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.0rc2:*:*:*:*:*:*:* Versions 1.4.0rc2 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.1:*:*:*:*:*:*:* Versions 1.4.1 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.2:*:*:*:*:*:*:* Versions 1.4.2 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.3:*:*:*:*:*:*:* Versions 1.4.3 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.4:*:*:*:*:*:*:* Versions 1.4.4 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.5:*:*:*:*:*:*:* Versions 1.4.5 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.6:*:*:*:*:*:*:* Versions 1.4.6 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.7:*:*:*:*:*:*:* Versions 1.4.7 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.8:*:*:*:*:*:*:* Versions 1.4.8 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.9:*:*:*:*:*:*:* Versions 1.4.9 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.10:*:*:*:*:*:*:* Versions 1.4.10 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.10rc1:*:*:*:*:*:*:* Versions 1.4.10rc1 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.4.11:*:*:*:*:*:*:* Versions 1.4.11 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.5.0a1:*:*:*:*:*:*:* Versions 1.5.0a1 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.5.0rc1:*:*:*:*:*:*:* Versions 1.5.0rc1 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.5.0rc2:*:*:*:*:*:*:* Versions 1.5.0rc2 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.5.0rc3:*:*:*:*:*:*:* Versions 1.5.0rc3 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.5.1:*:*:*:*:*:*:* Versions 1.5.1 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.5.2:*:*:*:*:*:*:* Versions 1.5.2 Vulnerable ·PHP Group
  • cpe:2.3:a:php_group:pear:1.5.3:*:*:*:*:*:*:* Versions 1.5.3 Vulnerable ·PHP Group

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2007-2519
  2. 2026-10-03 Alias added: GHSA-w4p3-mf5w-2mr6

References

Exploit 1

Advisory 2

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences