CVE-2018-1999022: PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's ge...

Security readout for executives and security teams

CVE-2018-1999022 is a code execution risk in PEAR HTML_QuickForm 3.2.14. A maliciously crafted web request could reach unsafe evaluation logic, potentially exposing information, changing data, or running arbitrary code. Public sources say it was fixed in 3.2.15. Exposure is most likely in PHP applications that use PEAR HTML_QuickForm 3.2.14, especially public or administrative forms that process request parameters through QuickForm. The bundle does not provide complete CPEs or a full affected-product list. Treat this as a high-priority legacy dependency issue where the vulnerable package is present on exposed PHP applications. The business urgency comes from potential arbitrary code execution, but evidence of active exploitation is not provided. Mitigation focus: Upgrade PEAR HTML_QuickForm to 3.2.15 or later where used.; Review the PEAR and CiviCRM advisories for environment-specific upgrade guidance.; Limit public access to administrative form endpoints until affected dependencies are remediated..

Prepared

Jun 7, 2026, 05:54 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.