CVE-2026-25236

Medium

Published: 03 February 2026

Published

03 February 2026

Modified

05 February 2026

KEV Added

—

Patch

—

CVSS Score v4 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0027 17.8th percentile

Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-25236 is a medium-severity SQL Injection (CWE-89) vulnerability in Pear Pearweb. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-25236 is a SQL injection vulnerability (CWE-89) in PEAR, a framework and distribution system for reusable PHP components. The flaw affects versions prior to 1.33.0 and stems from unsafe literal substitution in karma queries when handling IN (...) lists, enabling malicious SQL code execution. Published on 2026-02-03, it carries a CVSS v3.1 base score of 9.8, indicating critical severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and high impacts on confidentiality, integrity, and availability.

Unauthenticated attackers with network access can exploit this vulnerability remotely by crafting malicious inputs for karma queries. Successful exploitation allows arbitrary SQL execution, potentially leading to full compromise of the database, including data exfiltration, modification, or deletion, as well as potential server takeover depending on the environment and privileges of the database user.

The GitHub Security Advisory (GHSA-95mc-p966-c29f) confirms the issue and states that it has been patched in PEAR version 1.33.0. Security practitioners should upgrade to this version or later to mitigate the risk, and review any custom karma query implementations for similar unsafe substitution patterns.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-5199

Vulnerability details

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection risk exists in karma queries due to unsafe literal substitution for an IN (...) list. This issue has been patched in version…

1.33.0.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

SQL injection in publicly accessible PEAR PHP component directly enables remote unauthenticated exploitation of public-facing applications, allowing arbitrary SQL execution and database/server compromise.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0