CVE Intelligence
Analysis AI-assisted

CVE-2026-25236: PEAR Pearweb SQL Injection in Karma Queries

CVE-2026-25236 affects the Pearweb component of the PEAR PHP framework and distribution system. Prior to version 1.33.0, karma queries use unsafe literal substitution for an IN (...) list, creating a SQL injection risk. The issue is described as patched in version 1.33.0, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-25236 is a SQL injection weakness (CWE-89) in Pearweb, the web application behind the PEAR ecosystem for reusable PHP components. According to the record, karma queries substitute literal values into an IN (...) list in an unsafe way. The vulnerability is described as fixed in version 1.33.0.

Impact

  • The NVD record scores the issue at 9.8 (Critical) under CVSS 3.1, with high confidentiality, integrity and availability impact and no privileges or user interaction required.
  • GitHub's CNA assessment in the record lists a 6.9 score under CVSS 4.0.
  • The record does not describe the specific data that could be read or modified, so the practical consequences remain unknown.

Affected products and versions

  • Product: Pear Pearweb.
  • Affected range: versions before 1.33.0.
  • Fixed version: 1.33.0, as stated in the vulnerability description.

Exploitation status

The CISA KEV catalogue does not list this CVE in the record. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Upgrade Pearweb installations to version 1.33.0 or later, as stated by the advisory.
  • Review the vendor advisory GHSA-95mc-p966-c29f for maintainer guidance.
  • Where immediate upgrading is not possible, restrict access to affected administrative or karma-related functions and apply web application monitoring, without relying on this as a complete fix.

Detection guidance

  • Review web application and database logs for unusual query errors or anomalous input on karma-related functionality.
  • Monitor for unexpected database activity originating from the Pearweb application.

Limitations of the available information

The record does not provide the exact endpoints, parameters, or the data exposed. No EPSS score, SSVC data or fix commit reference is available. The fixes list is empty, so the 1.33.0 version is taken from the description and the vendor advisory reference.

Frequently asked questions

Which versions of Pearweb are affected by CVE-2026-25236?

According to the record, versions prior to 1.33.0 are affected.

What is the fixed version?

The vulnerability description states that it has been patched in version 1.33.0.

Is this vulnerability being actively exploited?

The CISA KEV catalogue does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.