CVE Intelligence
Analysis AI-assisted

CVE-2026-25241: Pear Pearweb Unauthenticated SQL Injection via Package Version Endpoint

PEAR Pearweb versions before 1.33.0 contain an unauthenticated SQL injection flaw (CWE-89) in a package endpoint that accepts a version value. The record states that remote attackers can run arbitrary SQL, and the issue is fixed in 1.33.0. CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

PEAR Pearweb, the web component of the PEAR PHP package framework, has an SQL injection flaw (CWE-89) in an endpoint that handles package versions. The record states that versions before 1.33.0 are affected and that the issue is patched in 1.33.0.

Impact

  • NVD rates the issue CVSS 3.1 9.8 (Critical), with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes a network-reachable attack needing no privileges or user interaction.
  • GitHub lists a CVSS 4.0 score of 9.3 for the same issue.
  • The record describes arbitrary SQL execution by remote attackers. The practical reach depends on the database permissions of the application, which the record does not describe.

Affected products and versions

  • Pear Pearweb: versions before 1.33.0.
  • The record's structured fixes list is empty, but the description identifies 1.33.0 as the patched version.

Exploitation status

The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation appears in the sources consulted. No EPSS score is available in the record.

Remediation and mitigation

  • Upgrade Pearweb to version 1.33.0 or later, as stated in the advisory and description.
  • Where an immediate upgrade is not possible, limit public exposure of the affected service and review the database account privileges used by the application to reduce potential impact. This is general defensive guidance, not a vendor recommendation.

Detection guidance

  • Review web server and application logs for unusual or malformed requests to package download endpoints.
  • Monitor database error logs for syntax errors originating from package lookup operations.
  • Compare deployed Pearweb versions against the 1.33.0 fix to identify exposed instances.

Limitations of the available information

  • The record does not give the lower bound of affected versions beyond the upper limit below 1.33.0.
  • No EPSS, SSVC or structured fixed-version data is present.
  • Detailed workarounds and vendor-provided mitigation steps are not included in the record. Consult the GitHub advisory and the NVD record for the latest details.

Frequently asked questions

Which versions of PEAR Pearweb are affected?

The record states that versions before 1.33.0 are affected. The lower bound of the affected range is not given.

Is this vulnerability being actively exploited?

It is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. The record does not include an EPSS score.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.