CVE Intelligence
Analysis AI-assisted

CVE-2026-25234: PEAR Pearweb: SQL Injection in Category Deletion

PEAR Pearweb versions before 1.33.0 contain a SQL injection flaw in category deletion, where a category id can be used to inject SQL. The record states the issue is patched in 1.33.0, and NVD rates it Critical with a CVSS 3.1 base score of 9.8. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-25234 is a SQL injection flaw (CWE-89) in the category deletion feature of Pearweb, the web application associated with the PEAR framework and distribution system. According to the record, an attacker with access to the category manager workflow can inject SQL through a category id. The issue is stated to be fixed in version 1.33.0.

Impact

NVD lists a CVSS 3.1 base score of 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes network attack, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability. The GitHub CNA record lists a CVSS 4.0 score of 5.3. The record does not describe which data could be read or changed.

Affected products and versions

  • Pear Pearweb: versions before 1.33.0, as listed in the record.

The structured fixes field is empty, but the description states the issue has been patched in 1.33.0. Treat 1.33.0 as the fixed version as stated by the record.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog, and no EPSS score is available. No confirmed exploitation appears in the sources consulted for this analysis.

Remediation and mitigation

  • Upgrade Pearweb to version 1.33.0 or later, as stated in the description and the GitHub security advisory.
  • Until the upgrade is applied, restrict access to the category manager workflow to a small set of trusted administrators.
  • Review which accounts hold category management permissions and remove any that are not required.
  • Confirm the deployed version after patching and keep a record of the change.

Detection guidance

  • Review web application and database logs for category deletion requests that contain unexpected or malformed category identifiers.
  • Watch for database errors raised during category operations, since these can indicate injection attempts.
  • Keep audit trails of administrative actions in the category manager and review them periodically.

Limitations of the available information

  • The record does not describe the exact conditions needed beyond access to the category manager workflow. The vector shows no privileges required, which should be reconciled with the description before assuming the precondition.
  • The fix is stated only in the description; the structured fixes list is empty.
  • EPSS is not available and KEV does not list the CVE, so exploitation likelihood cannot be assessed from these sources.
  • The record does not state whether deployments outside the official pearweb project are affected.
  • The CVSS 3.1 (9.8) and CVSS 4.0 (5.3) scores come from different providers and are not directly comparable.

Frequently asked questions

Which versions of PEAR Pearweb are affected by CVE-2026-25234?

The record lists Pear Pearweb versions before 1.33.0 as affected. The description states the issue is patched in version 1.33.0.

Is CVE-2026-25234 being actively exploited?

The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

What should administrators do first?

Upgrade Pearweb to version 1.33.0 or later, and restrict access to the category manager workflow to trusted administrators until the upgrade is applied.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.