CVE Intelligence
Analysis AI-assisted

CVE-2026-25237: PEAR Pearweb: PHP code execution via preg_replace /e modifier

PEAR Pearweb versions before 1.33.0 use preg_replace() with the /e modifier in bug update email handling. If attacker-controlled content reaches the evaluated replacement, PHP code may be executed, and the advisory states the issue is patched in 1.33.0. NVD rates it 9.8 (critical) under CVSS 3.1, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

PEAR is a framework and distribution system for reusable PHP components. This record concerns the Pearweb application, where bug update email handling uses preg_replace() with the /e modifier. The GitHub Security Advisory states that the issue is patched in version 1.33.0.

Impact

  • The record describes possible PHP code execution when attacker-controlled content reaches the evaluated replacement.
  • NVD scores the issue 9.8 under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which encodes network attack, low complexity, no privileges and no user interaction.
  • GitHub lists a CVSS 4.0 score of 9.2.
  • The weakness is classified as CWE-624 (Executable Regular Expression Error).

Affected products and versions

  • Product: Pear Pearweb, versions before 1.33.0.
  • The record lists no other affected version ranges.

Exploitation status

  • CISA KEV does not list this CVE in the record.
  • No confirmed active exploitation appears in the sources consulted.

Remediation and mitigation

  • Upgrade Pearweb to version 1.33.0 or later.
  • Until the upgrade is applied, check whether the bug update email feature is enabled and limit which external sources can submit content that reaches it.
  • Review any custom code in your environment that uses the /e modifier with preg_replace().

Detection guidance

  • Review application and mail-handling logs for unusual bug update submissions.
  • Search deployed code for preg_replace() calls that use the /e modifier.
  • Monitor web hosts for unexpected PHP process behavior and investigate any anomalies.

Limitations of the available information

  • The record does not describe the exact vulnerable code path, required conditions or any public proof of concept.
  • No exploit availability data, EPSS score or SSVC data is present.
  • The fixes list in the record is empty; the patched version comes from the description and the advisory reference.
  • The number of Pearweb deployments that are exposed is unknown.

Frequently asked questions

Is this vulnerability known to be actively exploited?

CISA KEV does not list this CVE in the record, and no confirmed active exploitation appears in the sources consulted.

Which version fixes the issue?

The record description and the GitHub advisory reference indicate that the issue is patched in Pearweb version 1.33.0.

Why is the severity rated critical?

NVD scores the issue 9.8 under CVSS 3.1, with a network attack vector, low complexity, no privileges and no user interaction in the vector.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.