The vulnerability arises from the use of preg_replace() with the /e modifier in bug update email handling within the PEAR framework. When attacker‑controlled content is passed to the evaluated replacement string, arbitrary PHP code can be executed. This flaw, classified as CWE‑624, allows attackers to run malicious code on the server, potentially compromising confidentiality, integrity, and availability of the affected system.

PEAR Web is affected. All installations of the PEAR framework and distribution system prior to version 1.33.0 are vulnerable. The problem exists in the bug update email handler component of the framework; no specific sub‑components are listed beyond the overall product.

The flaw has a CVSS score of 9.2, indicating a critical risk level. The EPSS score is below 1%, suggesting that wide‑scale exploitation is unlikely at present, and it is not yet catalogued in CISA’s KEV. Nonetheless, because the flaw permits remote code execution if an attacker can influence the content of a bug update email, the potential impact is substantial. A practical attack path could involve sending a specially crafted email that is parsed by the PEAR system, causing the /e modifier to evaluate user‑supplied code. Administrators should treat this as a high‑priority vulnerability.