CVE-2025-43717 PEAR HTTP_Request2 vulnerable to Cross-site Scripting
An attacker can execute arbitrary scripts in the victim's browser via reflected XSS in the test files of the PEAR HTTP_Request2 library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-43717?
CVE-2025-43717 is a medium-severity cross-site scripting vulnerability in avb HTTP_Request2, published on 17 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In PEAR HTTP_Request2 before 2.7.0, multiple files in the tests directory, notably tests/_network/getparameters.php and tests/_network/postparameters.php, reflect any GET or POST parameters, leading to XSS.
Weakness: CWE-531
Which versions are affected by CVE-2025-43717?
2 open source packages ship an affected version, including pear/http_request2.
| Package | Affected | Fixed in |
|---|---|---|
pear/http_request2 Packagist | All versions | 2.7.0 |
pear/http_request2 Packagist | All versions | 2.7.0 |
How do I fix CVE-2025-43717?
Upgrade pear/http_request2 to 2.7.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-43717 being exploited?
There is no known exploitation of CVE-2025-43717 in the wild and no public exploit code.
Sources
Also known as GHSA-w7gh-f2fm-9q8r.