CVE-2026-25234
Published: 03 February 2026
Summary
CVE-2026-25234 is a critical-severity SQL Injection (CWE-89) vulnerability in Pear Pearweb. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection by requiring validation of the category ID parameter before its use in database queries.
Requires timely installation of the PEAR 1.33.0 patch that specifically remediates this SQL injection vulnerability.
Restricts the category ID input to safe, expected formats such as integers, blocking malicious SQL injection payloads.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in the category deletion workflow of the PEAR web application (pearweb) provides a direct remote exploitation vector against a public-facing web app with no authentication or user interaction required.
NVD Description
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in category deletion can allow an attacker with access to the category manager workflow to inject SQL via a category id.…
more
This issue has been patched in version 1.33.0.
Deeper analysisAI
CVE-2026-25234 is a SQL injection vulnerability (CWE-89) in PEAR, a framework and distribution system for reusable PHP components. The issue affects versions prior to 1.33.0 and resides in the category deletion functionality, where an attacker can inject SQL via a category ID parameter. Published on 2026-02-03, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with potential for high impacts on confidentiality, integrity, and availability.
An attacker with access to the category manager workflow can exploit this vulnerability remotely with low attack complexity and no user interaction. Exploitation allows arbitrary SQL injection through the category ID, enabling data manipulation, extraction, or disruption depending on the backend database privileges.
The vulnerability has been patched in PEAR version 1.33.0. Additional details on the fix and affected components are available in the GitHub security advisory at https://github.com/pear/pearweb/security/advisories/GHSA-q28j-3p7r-6722.
Details
- CWE(s)