CVE Intelligence
Analysis AI-assisted

CVE-2026-25238: PEAR Pearweb: SQL injection in bug subscription deletion

PEAR Pearweb versions before 1.33.0 contain a SQL injection flaw in bug subscription deletion that can be triggered through a crafted email value. NVD scores the issue 9.8 (critical) under CVSS 3.1, and the record states it is patched in version 1.33.0. The record shows no KEV listing and no confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-25238 affects PEAR Pearweb, the web application associated with the PEAR framework and distribution system for reusable PHP components. According to the record, the bug subscription deletion function does not properly handle a crafted email value, which leads to SQL injection (CWE-89).

Impact

  • NVD lists a CVSS 3.1 base score of 9.8 (critical), with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
  • The GitHub CNA record lists a CVSS 4.0 score of 9.2 for the same issue.
  • Successful exploitation could allow an attacker to read, alter or destroy data stored in the backing database, according to the general nature of SQL injection. This is an inference from the CWE classification.

Affected products and versions

  • Pear Pearweb versions prior to 1.33.0 (listed as less than 1.33.0).
  • The record states the issue has been patched in version 1.33.0.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record (listed: false).
  • No confirmed exploitation in the wild appears in the sources consulted for this analysis.

Remediation and mitigation

  • Upgrade Pearweb to version 1.33.0 or later, as stated in the record.
  • Review the GitHub security advisory for vendor guidance.
  • Until the upgrade is applied, limit public exposure of the bug subscription features and restrict access to authenticated users where feasible.
  • Validate and constrain input at the web application and proxy layers as a defence-in-depth measure.

Detection guidance

  • Review web server and application logs for unusual or malformed requests to bug subscription endpoints, especially those containing unexpected email values.
  • Monitor database logs for SQL syntax errors that originate from these application requests.
  • Correlate anomalies with user accounts and source addresses to support incident triage.

Limitations of the available information

  • The record does not provide a structured list of fixed versions; the version 1.33.0 patch comes from the description.
  • The record does not identify the exact endpoint path or the full set of affected deployments.
  • EPSS and SSVC data are not available in the record, so exploitation likelihood is unknown.
  • The CVSS scores differ between NVD (3.1) and GitHub (4.0), and the record does not explain the difference.

Frequently asked questions

What is CVE-2026-25238?

It is a SQL injection vulnerability in the bug subscription deletion function of PEAR Pearweb, triggered by a crafted email value, affecting versions before 1.33.0.

Which version fixes the issue?

According to the record, the issue is patched in PEAR Pearweb version 1.33.0. Administrators should upgrade to that version or later.

Is this vulnerability being actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted for this analysis.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.