Cyber Resilience

CVE-2026-25238

Critical

Published: 03 February 2026

Published
03 February 2026
Modified
05 February 2026
KEV Added
—
Patch
—
CVSS Score v4 9.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0027 17.8th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-25238 is a critical-severity SQL Injection (CWE-89) vulnerability in Pear Pearweb. Its CVSS base score is 9.2 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-25238 is a SQL injection vulnerability (CWE-89) affecting PEAR, a framework and distribution system for reusable PHP components. The flaw exists in the bug subscription deletion functionality prior to version 1.33.0, where attackers can inject malicious SQL via a crafted email value.

Remote attackers require only network access to exploit this vulnerability, with no authentication, privileges, or user interaction needed, as reflected in its CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Successful exploitation enables high-impact violations of confidentiality, integrity, and availability, potentially allowing arbitrary SQL execution and full database compromise.

The vulnerability has been patched in PEAR version 1.33.0. Additional details are available in the GitHub security advisory at https://github.com/pear/pearweb/security/advisories/GHSA-cv3c-27h5-7gmv.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in bug subscription deletion may allow attackers to inject SQL via a crafted email value. This issue has been patched in…

more

version 1.33.0.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Unauthenticated remote SQL injection in public-facing PEAR web application directly enables exploitation via T1190 (Exploit Public-Facing Application); arbitrary SQL execution and full DB compromise are direct consequences of successful T1190 abuse.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-25236Same product: Pear Pearweb
CVE-2026-25240Same product: Pear Pearweb
CVE-2026-25234Same product: Pear Pearweb
CVE-2026-25241Same product: Pear Pearweb
CVE-2026-25239Same product: Pear Pearweb
CVE-2026-25237Same product: Pear Pearweb
CVE-2026-25235Same product: Pear Pearweb
CVE-2026-25233Same product: Pear Pearweb
CVE-2026-24956Shared CWE-89
CVE-2026-33615Shared CWE-89

Affected Assets

pear
pearweb
≤ 1.33.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly implements input validation at externally-facing interfaces to sanitize crafted email values and prevent SQL injection in the bug subscription deletion functionality.

SI-9 Information Input Restrictions good match
prevent

Restricts information inputs to predefined specifications, blocking malicious SQL payloads via email in PEAR's vulnerable endpoint.

SI-2 Flaw Remediation good match
prevent

Requires timely identification, reporting, and patching of the specific SQL injection flaw fixed in PEAR version 1.33.0.

References