CVE-2026-25237: PEAR is Vulnerable to PHP Code Execution via preg_replace /e in Bug Update Emails
Published Feb 3, 2026
·Updated
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, use of pregreplace() with the /e modifier in bug update email handling can enable PHP code execution if attacker-controlled content reaches the evaluated replacement. This issue has been patched in version 1.33.0.
Affected Software
2 affected components
pear/pear<1.33.0
PEAR Pearweb<1.33.0
Event History
Feb 3, 2026
CVE Published
via MITRE·06:29 PM
Data Sourced
via MITRE·06:29 PM
DescriptionWeakness
Data Sourced
via NVD·07:16 PM
DescriptionSeverityWeaknessAffected Software
Jun 19, 58090
Event
via FIRST·08:15 PM
Frequently Asked Questions
1
What is the severity of CVE-2026-25237?
CVE-2026-25237 is rated as a critical vulnerability due to its potential for PHP code execution.
2
How do I fix CVE-2026-25237?
To remediate CVE-2026-25237, upgrade PEAR to version 1.33.0 or later.
3
What versions of PEAR are affected by CVE-2026-25237?
PEAR versions prior to 1.33.0 are vulnerable to CVE-2026-25237.
4
What type of vulnerability is CVE-2026-25237?
CVE-2026-25237 is a PHP code execution vulnerability caused by the use of preg_replace() with the /e modifier.
5
Can CVE-2026-25237 be exploited remotely?
Yes, CVE-2026-25237 can be exploited remotely if an attacker can send crafted bug update emails.