CVE-2026-25233
Pearweb ≤ 1.33.0
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-25233 is a high-severity Operator Precedence Logic Error (CWE-783) vulnerability in Pear Pearweb. Its CVSS base score is 7.1 (High).
Operationally, ranked at the 24th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-25233 is a logic bug in the roadmap role check within PEAR, a framework and distribution system for reusable PHP components. The vulnerability affects PEAR versions prior to 1.33.0, specifically in the pearweb component, and was published on 2026-02-03. It has been assigned CWE-783 (Operator Missing Right Operand) and a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), indicating critical severity due to high integrity and availability impacts with no confidentiality loss.
The vulnerability enables attackers with network access to exploit it with low complexity, no privileges, and no user interaction required. Non-lead maintainers can create, update, or delete roadmaps, potentially allowing unauthorized manipulation of project roadmaps in the PEAR ecosystem, which could disrupt development planning or introduce misleading information.
The GitHub security advisory (GHSA-p92v-9j73-fxx3) confirms the issue has been patched in PEAR version 1.33.0. Security practitioners should upgrade to this version or later to mitigate the vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5202
Vulnerability Data
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, logic bug in the roadmap role check allows non-lead maintainers to create, update, or delete roadmaps. This issue has been patched in version 1.33.0.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and static analysis directly find incorrect evaluation results caused by precedence mistakes.
Documented development standards and coding rules can require constructs that eliminate ambiguous operator precedence.
Engineering principles can mandate explicit parentheses and precedence rules that structurally prevent the logic error from being written.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices (reviews, static analysis, testing) directly catch precedence errors while the control also addresses many other development risks.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect logic errors caused by precedence issues.
Secure development lifecycle includes code review and testing that can catch precedence errors.
Secure coding standards and guidelines directly address operator precedence mistakes.