Unrated severityNVD Advisory· Published May 22, 2007· Updated Apr 23, 2026
CVE-2007-2519
CVE-2007-2519
Description
Directory traversal vulnerability in the installer in PEAR 1.0 through 1.5.3 allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in the (1) install-as attribute in the file element in package.xml 1.0 or the (2) as attribute in the install element in package.xml 2.0. NOTE: it could be argued that this does not cross privilege boundaries in typical installations, since the code being installed could perform the same actions.
Affected products
59cpe:2.3:a:php_group:pear:1.0:*:*:*:*:*:*:*+ 58 more
- cpe:2.3:a:php_group:pear:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.1:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.2:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.2b1:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.2b2:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.2b3:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.2b4:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.2b5:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.3:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.3.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.3b1:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.3b2:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.3b3:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.3b5:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.3b6:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.0a1:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.0a10:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.0a11:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.0a12:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.0a2:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.0a3:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.0a4:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.0a5:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.0a6:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.0a7:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.0a8:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.0a9:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.0b1:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.0b2:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.0rc1:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.0rc2:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.10:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.10rc1:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.11:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.7:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.8:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.4.9:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.5.0a1:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.5.0rc1:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.5.0rc2:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.5.0rc3:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:php_group:pear:1.5.3:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
9- pear.php.net/advisory-20070507.txtnvdExploitPatchVendor Advisory
- osvdb.org/42108nvd
- pear.php.net/news/vulnerability2.phpnvd
- secunia.com/advisories/25372nvd
- www.mandriva.com/security/advisoriesnvd
- www.securityfocus.com/bid/24111nvd
- www.ubuntu.com/usn/usn-462-1nvd
- www.vupen.com/english/advisories/2007/1926nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/34482nvd
News mentions
0No linked articles in our index yet.