CVE-2026-25237 is a critical flaw (CVSS 9.8) in pearweb, the code behind the PEAR PHP package site. Use of preg_replace() with the /e modifier in bug update email handling can enable PHP code execution. PEAR's pearweb 1.33.0 fixes it, so anyone who runs pearweb or a fork of it should upgrade.
What's affected
- Affected: pearweb before 1.33.0.
- Fixed in: 1.33.0.
This concerns the pearweb web application. It is not the PEAR library packages you install with a package manager, so most PHP developers are not affected. The risk is for anyone who hosts pearweb, runs a mirror or a fork, or copied code from it.
The advisory points to mail_bug_updates() in the bugs include file. The /e modifier makes PHP evaluate the replacement as code, so attacker controlled content such as a bug comment may break out of its quoting and run.
How to check if you're exposed
Check which version of pearweb you deploy. If you track it through git, look at the tag or commit you are on and compare it with 1.33.0.
git describe --tags
If you run a fork, search your own copy for the file and function named in the advisory, because a fork may not have received the fix.
What to do now
- Upgrade pearweb to 1.33.0 or later.
- If you run a fork, port the fix from 1.33.0 and review neighbouring code for the same pattern.
- Restrict access to the affected workflow until you have upgraded.
- Check your database and application logs for unusual requests to the affected page.
- Run a static analysis scan on the code base to find similar cases.
Why it matters
The /e modifier evaluates the replacement string as PHP. It was deprecated and later removed from PHP for this reason. If user text can reach the evaluated string, the author of that text can run code. The advisory rates it critical and describes potential remote code execution. The weakness is CWE-624 (Executable Regular Expression Error).
Six pearweb advisories were published on the same day, found by the same researchers. When one component has several flaws of the same type, it is a sign that the pattern is common in the code, so review beyond the single fix.
Quick check
Why is the /e modifier dangerous?
It evaluates the replacement as PHP code. The advisory says attacker controlled content that escapes its quoting can lead to code execution.
Sources
Last reviewed: 19 October 2026.
