CVE-2026-25237
Pearweb ≤ 1.33.0
Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-25237 is a critical-severity Executable Regular Expression Error (CWE-624) vulnerability in Pear Pearweb. Its CVSS base score is 9.2 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 33th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-25237 is a critical vulnerability in PEAR, a framework and distribution system for reusable PHP components. Prior to version 1.33.0, the bug update email handling feature improperly uses the preg_replace() function with the /e modifier, which evaluates PHP code in the replacement string. If attacker-controlled content reaches this evaluated replacement, it enables arbitrary PHP code execution on the affected server. The vulnerability is rated 9.8 on the CVSS 3.1 scale (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-624.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction required. Exploitation occurs by injecting malicious content into bug update emails processed by the PEAR system, such as through manipulated bug reports or email inputs that trigger the flawed preg_replace() call. Successful exploitation grants full PHP code execution on the server, potentially allowing complete compromise including data theft, modification, or server takeover.
The GitHub security advisory at https://github.com/pear/pearweb/security/advisories/GHSA-vhw6-hqh9-8r23 details the patch in PEAR version 1.33.0, which addresses the insecure use of the /e modifier. Security practitioners should upgrade to version 1.33.0 or later and review any custom email handling in PEAR deployments for similar preg_replace() patterns.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5198
Vulnerability Data
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, use of preg_replace() with the /e modifier in bug update email handling can enable PHP code execution if attacker-controlled content reaches the evaluated replacement. This…
more
issue has been patched in version 1.33.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover regex patterns that accept or enable executable user input.
Security engineering principles applied during design require avoiding unsafe constructs such as executable regex with untrusted input.
Validating inputs before they reach a regex engine structurally blocks user-controlled executable components or modifiers.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent use of executable regex with untrusted input via reviews, static analysis, and safe-coding standards.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect executable regex flaws before production deployment.
Secure development lifecycle includes input validation and regex review that can prevent executable regex patterns.
Application security requirements can mandate safe regex handling and input sanitization.
Secure architecture principles discourage embedding user-controlled executable regex components.
Secure coding standards directly address safe regex construction and ban user-supplied pattern modifiers.