CVE-2007-1460

N/A Unknown

Published: March 14, 2007 Modified: April 23, 2026

Description

The zip:// URL wrapper provided by the PECL zip extension in PHP before 4.4.7, and 5.2.0 and 5.2.1, does not implement safemode or open_basedir checks, which allows remote attackers to read ZIP archives located outside of the intended directories.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

http://docs.info.apple.com/article.html?artnum=306172

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html

Source: cve@mitre.org

http://secunia.com/advisories/25056

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/26235

Source: cve@mitre.org

Vendor Advisory

http://us2.php.net/releases/4_4_7.php

Source: cve@mitre.org

http://us2.php.net/releases/5_2_2.php

Source: cve@mitre.org

http://www.novell.com/linux/security/advisories/2007_32_php.html

Source: cve@mitre.org

http://www.php-security.org/MOPB/MOPB-20-2007.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/22954

Source: cve@mitre.org

http://www.securityfocus.com/bid/25159

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/2732

Source: cve@mitre.org

Vendor Advisory

http://docs.info.apple.com/article.html?artnum=306172