CVE-2022-24953: PEAR Crypt Gpg

Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days.

The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions.

Affected products

• PEAR Crypt Gpg: before 1.6.7 (fixed in 1.6.7)

Published 2022-02-17. Last modified 2026-06-17.