CVE-2026-25238
Published: 03 February 2026
Summary
CVE-2026-25238 is a critical-severity SQL Injection (CWE-89) vulnerability in Pear Pearweb. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly implements input validation at externally-facing interfaces to sanitize crafted email values and prevent SQL injection in the bug subscription deletion functionality.
Restricts information inputs to predefined specifications, blocking malicious SQL payloads via email in PEAR's vulnerable endpoint.
Requires timely identification, reporting, and patching of the specific SQL injection flaw fixed in PEAR version 1.33.0.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote SQL injection in public-facing PEAR web application directly enables exploitation via T1190 (Exploit Public-Facing Application); arbitrary SQL execution and full DB compromise are direct consequences of successful T1190 abuse.
NVD Description
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in bug subscription deletion may allow attackers to inject SQL via a crafted email value. This issue has been patched in…
more
version 1.33.0.
Deeper analysisAI
CVE-2026-25238 is a SQL injection vulnerability (CWE-89) affecting PEAR, a framework and distribution system for reusable PHP components. The flaw exists in the bug subscription deletion functionality prior to version 1.33.0, where attackers can inject malicious SQL via a crafted email value.
Remote attackers require only network access to exploit this vulnerability, with no authentication, privileges, or user interaction needed, as reflected in its CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Successful exploitation enables high-impact violations of confidentiality, integrity, and availability, potentially allowing arbitrary SQL execution and full database compromise.
The vulnerability has been patched in PEAR version 1.33.0. Additional details are available in the GitHub security advisory at https://github.com/pear/pearweb/security/advisories/GHSA-cv3c-27h5-7gmv.
Details
- CWE(s)