CVE-2026-25239

8.2 highEPSS 0.2%

High (8.2) in pear pearweb. EPSS 0.2% chance of exploitation in the next 30 days.

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in apidoc queue insertion can allow query manipulation if an attacker can influence the inserted filename value. This issue has been patched in version 1.33.0.

Severity

CVSS 4.0

8.2 high

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2026-02-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

pear:pearweb

References

https://github.com/pear/pearweb/security/advisories/GHSA-f9mg-x463-3vxg

Check your stack JSON