CVE-2026-25236
Published: 03 February 2026
Summary
CVE-2026-25236 is a critical-severity SQL Injection (CWE-89) vulnerability in Pear Pearweb. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the CVE by requiring timely patching of the SQL injection flaw fixed in PEAR version 1.33.0.
Prevents SQL injection exploitation by enforcing validation of all inputs used in karma queries before literal substitution into IN lists.
Enables proactive detection of the SQL injection vulnerability in PEAR through regular scanning, facilitating remediation before remote exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in publicly accessible PEAR PHP component directly enables remote unauthenticated exploitation of public-facing applications, allowing arbitrary SQL execution and database/server compromise.
NVD Description
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection risk exists in karma queries due to unsafe literal substitution for an IN (...) list. This issue has been patched in version…
more
1.33.0.
Deeper analysisAI
CVE-2026-25236 is a SQL injection vulnerability (CWE-89) in PEAR, a framework and distribution system for reusable PHP components. The flaw affects versions prior to 1.33.0 and stems from unsafe literal substitution in karma queries when handling IN (...) lists, enabling malicious SQL code execution. Published on 2026-02-03, it carries a CVSS v3.1 base score of 9.8, indicating critical severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and high impacts on confidentiality, integrity, and availability.
Unauthenticated attackers with network access can exploit this vulnerability remotely by crafting malicious inputs for karma queries. Successful exploitation allows arbitrary SQL execution, potentially leading to full compromise of the database, including data exfiltration, modification, or deletion, as well as potential server takeover depending on the environment and privileges of the database user.
The GitHub Security Advisory (GHSA-95mc-p966-c29f) confirms the issue and states that it has been patched in PEAR version 1.33.0. Security practitioners should upgrade to this version or later to mitigate the risk, and review any custom karma query implementations for similar unsafe substitution patterns.
Details
- CWE(s)