CVE-2011-1072: The installer in PEAR before 1.9.2 allows local users to overwrite arbitrary files via a symlink attack on...

Security readout for executives and security teams

CVE-2011-1072 is an old PEAR installer flaw where a local user could abuse symlinks to make a privileged install overwrite files. It matters mainly on shared servers or build hosts where PEAR runs with higher privileges. The bundle does not show internet-facing exploitation or active exploitation evidence. Exposure is most likely on legacy PHP systems, shared hosting, developer machines, or CI/build hosts that still use PEAR installer versions before 1.9.2, especially where local untrusted users can write to relevant temporary or cache paths. Treat this as a legacy local privilege-risk item, not an emergency internet-facing issue. Prioritize remediation on shared servers, build infrastructure, and any system where untrusted users coexist with privileged PEAR operations. Mitigation focus: Upgrade PEAR installer to 1.9.2 or later where still in use.; Apply distribution vendor fixes from supported OS channels.; Avoid running PEAR package installation as root unless required..

Prepared

Jun 24, 2026, 13:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.