A vulnerability was found in php-pear where if a malicious server responded to a pear
This vulnerability only allows files in the current directory to be overwritten, so using pear download
in a temporary directory effectively mitigates the risk of a dangerous file overwrite occurring.