PEAR Remote Code Execution Vulnerability via preg_replace() with /e Modifier in Bug Update Email Handling

A remote code execution vulnerability has been identified in PEAR versions prior to 1.33.0. The issue arises from the use of preg_replace() with the /e modifier in the mail_bug_updates() function, located in public_html/bugs/include/functions.inc. This combination can lead to PHP code execution if attacker-controlled content, such as bug comments, is processed and escapes the intended quoting context.

Impact

Exploitation of this vulnerability allows for arbitrary PHP code execution on the server.

Remediation

Users can upgrade to PEAR version 1.33.0 or later to address this vulnerability.