PT-2026-6286 · Pear · Pear

Megamansec

·

CVE-2026-25237

·

Publicado

2026-02-03

·

Atualizado

2026-02-04

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions PEAR versions prior to 1.33.0
Description PEAR, a framework for reusable PHP components, contains a flaw related to the use of the preg replace() function with the /e modifier. This can lead to PHP code execution if attacker-controlled content is used in the replacement process during bug update email handling.
Recommendations Update to version 1.33.0 or later.

Exploit

Correção

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-624

Identificadores relacionados

CVE-2026-25237
GHSA-VHW6-HQH9-8R23

Produtos afetados

Pear