preg_replace /e Modifier (Removed)

TL;DR

Explanation

preg_replace($pattern . 'e', $replacement, $subject) evaluated $replacement as PHP code after substitution. This allowed: preg_replace('/.*/e', $_GET['cmd'], '') — direct remote code execution from user input. Removed in PHP 7.0 (was deprecated in PHP 5.5). The replacement is preg_replace_callback() with an explicit closure. Any legacy codebase running on PHP 5 with user input touching preg_replace with the /e flag has a critical RCE. Check all preg_replace calls for the 'e' flag in regex patterns.

Common Misconception

Why It Matters

Common Mistakes

• Any use of preg_replace with /e flag from user input.
• Not auditing all preg_replace calls in legacy codebases.
• Using variable patterns: preg_replace($userPattern . 'e', ...).

Code Examples

// PHP 5 — critical RCE:
preg_replace('/' . $_GET['pattern'] . '/e',
             $_GET['replacement'],
             $subject);
// Attacker: ?pattern=.*&replacement=system('cat /etc/passwd')

// PHP 7+ — use preg_replace_callback:
$result = preg_replace_callback(
    '/([a-z]+)/',
    function(array $matches): string {
        return strtoupper($matches[1]);
    },
    $subject
);
// Never pass user input as the callback

References

• ↗ https://www.php.net/manual/en/reference.pcre.pattern.modifiers.php

Tags

Related Terms