CVE Intelligence
Analysis AI-assisted

CVE-2026-25240: PEAR Pearweb SQL Injection in user::maintains() Role Filter

CVE-2026-25240 is a SQL injection flaw in the PEAR Pearweb project affecting versions before 1.33.0. The issue occurs in user::maintains() when role filters are passed as an array and inserted into an IN clause. The record states the problem is patched in version 1.33.0, and NVD rates it 9.8 under CVSS 3.1.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

PEAR is a framework and distribution system for reusable PHP components. According to the vendor advisory and the CVE record, the Pearweb project contains a SQL injection flaw in user::maintains() when role filters are supplied as an array and inserted into an IN clause. The record states the issue is patched in version 1.33.0.

Impact

  • Successful exploitation could allow an attacker to influence database queries executed by the affected function.
  • NVD scores the issue 9.8 under CVSS 3.1, with network attack vector, low complexity, no privileges and no user interaction required, and high impact to confidentiality, integrity and availability.
  • The GitHub CNA scored the issue 6.9 under CVSS 4.0.

Affected products and versions

  • Product: Pear Pearweb.
  • Affected versions: those before 1.33.0.
  • Patched version: 1.33.0, as stated in the record description.
  • The structured fixes field in the record is empty, so further patch details are not available in the data reviewed.

Exploitation status

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog according to the record. No confirmed active exploitation appears in the sources consulted for this analysis.

Remediation and mitigation

  • Upgrade Pearweb to version 1.33.0 or later.
  • Consult the vendor advisory for maintainer guidance.
  • If an upgrade cannot be applied immediately, limit access to user management functionality to trusted administrators and review how role filter inputs are handled at the application layer.

Detection guidance

  • Review web application and database logs for unusual or malformed role filter parameters on user management pages.
  • Monitor for unexpected changes to user accounts or role assignments.
  • Investigate database errors that appear in response to user management requests.

Limitations of the available information

The sources do not describe the exact vulnerable code change, the deployment configurations affected in practice, or any exploitation telemetry. The EPSS score is not available in the record. Whether earlier releases or forks outside the stated range are affected is unknown.

Frequently asked questions

What is CVE-2026-25240?

It is a SQL injection vulnerability in PEAR Pearweb before version 1.33.0, occurring in user::maintains() when role filters are passed as an array into an IN clause.

Which version fixes the issue?

According to the record description, the issue is patched in version 1.33.0. The structured fixes field in the record is empty.

Is this vulnerability known to be exploited?

The record does not list it in CISA KEV, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.