Issue #2508735 by darol100, dawehner, pwolanin, Chi, Fabianx, tim.plunkett: Code injection via preg_replace()