CVE-2026-25240
Published: 03 February 2026
Summary
CVE-2026-25240 is a critical-severity SQL Injection (CWE-89) vulnerability in Pear Pearweb. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates SQL injection by requiring validation of untrusted role filter array inputs before interpolation into SQL IN clauses.
Ensures timely patching of the specific SQL injection flaw in PEAR user::maintains() by upgrading to version 1.33.0.
Identifies SQL injection vulnerabilities like CVE-2026-25240 through scanning and mandates remediation to prevent exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing PEAR web component (user::maintains) directly enables remote exploitation of the application for initial access and subsequent database impact without authentication.
NVD Description
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability can occur in user::maintains() when role filters are provided as an array and interpolated into an IN (...) clause. This issue…
more
has been patched in version 1.33.0.
Deeper analysisAI
CVE-2026-25240 is a SQL injection vulnerability (CWE-89) in the PEAR framework and distribution system for reusable PHP components. The flaw exists in the user::maintains() function prior to version 1.33.0, where role filters provided as an array are directly interpolated into an SQL IN (...) clause, enabling malicious input to alter query logic. Published on 2026-02-03 with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), it affects PEAR installations vulnerable to untrusted input in this context.
Remote attackers require no privileges, authentication, or user interaction to exploit this over the network with low complexity. By supplying a crafted array as role filters to the user::maintains() function, attackers can inject arbitrary SQL, potentially leading to high-impact compromise including unauthorized data access, modification, or deletion on the underlying database.
The GitHub security advisory at https://github.com/pear/pearweb/security/advisories/GHSA-xw9g-5gr2-c44f confirms the issue and states it has been patched in PEAR version 1.33.0, recommending immediate upgrades for affected installations.
Details
- CWE(s)