CVE-2026-25240

Medium

Published: 03 February 2026

Published

03 February 2026

Modified

05 February 2026

KEV Added

—

Patch

—

CVSS Score v4 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0027 17.8th percentile

Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-25240 is a medium-severity SQL Injection (CWE-89) vulnerability in Pear Pearweb. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2026-25240 is a SQL injection vulnerability (CWE-89) in the PEAR framework and distribution system for reusable PHP components. The flaw exists in the user::maintains() function prior to version 1.33.0, where role filters provided as an array are directly interpolated into an SQL IN (...) clause, enabling malicious input to alter query logic. Published on 2026-02-03 with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), it affects PEAR installations vulnerable to untrusted input in this context.

Remote attackers require no privileges, authentication, or user interaction to exploit this over the network with low complexity. By supplying a crafted array as role filters to the user::maintains() function, attackers can inject arbitrary SQL, potentially leading to high-impact compromise including unauthorized data access, modification, or deletion on the underlying database.

The GitHub security advisory at https://github.com/pear/pearweb/security/advisories/GHSA-xw9g-5gr2-c44f confirms the issue and states it has been patched in PEAR version 1.33.0, recommending immediate upgrades for affected installations.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-5195

Vulnerability details

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability can occur in user::maintains() when role filters are provided as an array and interpolated into an IN (...) clause. This issue…

has been patched in version 1.33.0.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

SQL injection in public-facing PEAR web component (user::maintains) directly enables remote exploitation of the application for initial access and subsequent database impact without authentication.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0