PT-2026-6289 · Pear · Pear

Megamansec · Published 2026-02-03 · Updated 2026-02-05 · CVE-2026-25240

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PEAR versions prior to 1.33.0

Description PEAR is a framework and distribution system for reusable PHP components. A SQL injection issue can occur in the user::maintains() function when role filters are provided as an array and interpolated into an IN (...) clause. The vulnerable parameter is the role filter array.

Recommendations Update to version 1.33.0 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-25240

GHSA-XW9G-5GR2-C44F

Affected Products

Pear

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25240.json · Exploit
• https://github.com/pear/pearweb/security/advisories/GHSA-xw9g-5gr2-c44f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25240 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-25240 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-25240 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25240 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-25240 · Security Note
• https://twitter.com/TheHackerWire/status/2019474983731539986 · Twitter Post