CVE-2026-25233 is a critical flaw (CVSS 9.1) in pearweb, the code behind the PEAR PHP package site. A logic bug in the roadmap role check lets maintainers who are not leads create, update or delete roadmaps. PEAR's pearweb 1.33.0 fixes it, so anyone who runs pearweb or a fork of it should upgrade.
What's affected
- Affected: pearweb before 1.33.0.
- Fixed in: 1.33.0.
This concerns the pearweb web application. It is not the PEAR library packages you install with a package manager, so most PHP developers are not affected. The risk is for anyone who hosts pearweb, runs a mirror or a fork, or copied code from it.
The advisory gives the cause. In the roadmap page, the condition that is meant to check for the lead role mixes a negation with a comparison, and operator precedence makes it behave differently from what the author intended, so non lead users pass the check.
How to check if you're exposed
Check which version of pearweb you deploy. If you track it through git, look at the tag or commit you are on and compare it with 1.33.0.
git describe --tags
If you run a fork, search your own copy for the file and function named in the advisory, because a fork may not have received the fix.
What to do now
- Upgrade pearweb to 1.33.0 or later.
- If you run a fork, port the fix from 1.33.0 and review neighbouring code for the same pattern.
- Restrict access to the affected workflow until you have upgraded.
- Check your database and application logs for unusual requests to the affected page.
- Run a static analysis scan on the code base to find similar cases.
Why it matters
The check is written so that a negation applies before a comparison. In most languages that evaluates to something other than "is this user not a lead". The result is an authorization bypass, which the advisory describes as privilege escalation for roadmap management. The weakness is CWE-783 (Operator Precedence Logic Error).
Six pearweb advisories were published on the same day, found by the same researchers. When one component has several flaws of the same type, it is a sign that the pattern is common in the code, so review beyond the single fix.
Quick check
Is this a SQL injection?
No. It is a logic error in a permission check. The advisory rates it high, while the NVD record scores it 9.1.
Sources
Last reviewed: 19 October 2026.
