Skip to content
CVE PROGRAM SOURCE RECORD9.2 Critical

CVE-2026-25237

PEAR is Vulnerable to PHP Code Execution via preg_replace /e in Bug Update Emails

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, use of preg_replace() with the /e modifier in bug update email handling can enable PHP code execution if attacker-controlled content reaches the evaluated replacement. This issue has been patched in version 1.33.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

pear pearweb

  • < 1.33.0affected

References