CVE-2026-25239
Published: 03 February 2026
Summary
CVE-2026-25239 is a high-severity SQL Injection (CWE-89) vulnerability in Pear Pearweb. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing pearweb component enables remote exploitation of Internet-facing app (T1190) and directly facilitates stored data manipulation via arbitrary SQL changes to database contents (T1565.001).
NVD Description
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in apidoc queue insertion can allow query manipulation if an attacker can influence the inserted filename value. This issue has been…
more
patched in version 1.33.0.
Deeper analysisAI
CVE-2026-25239 is a SQL injection vulnerability (CWE-89) affecting PEAR, a framework and distribution system for reusable PHP components, specifically in the pearweb component. Prior to version 1.33.0, the apidoc queue insertion process fails to properly sanitize the inserted filename value, allowing attackers to manipulate SQL queries. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), indicating high severity due to its potential for integrity compromise without requiring authentication or user interaction.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity by supplying a malicious filename value during apidoc queue insertion. Successful exploitation enables arbitrary SQL query manipulation, potentially allowing the attacker to alter database contents, insert unauthorized data, or execute other integrity-impacting operations, though it does not grant confidentiality access or disrupt availability.
The GitHub security advisory (GHSA-f9mg-x463-3vxg) confirms the issue was patched in PEAR version 1.33.0. Security practitioners should upgrade to this version or later to mitigate the vulnerability, and review any custom integrations involving apidoc queue handling for additional input validation.
Details
- CWE(s)