CVE-2026-25234 is a critical flaw (CVSS 9.8) in pearweb, the code behind the PEAR PHP package site. A SQL injection in category deletion lets someone with access to the category manager workflow inject SQL through a category id. PEAR's pearweb 1.33.0 fixes it, so anyone who runs pearweb or a fork of it should upgrade.
What's affected
- Affected: pearweb before 1.33.0.
- Fixed in: 1.33.0.
This concerns the pearweb web application. It is not the PEAR library packages you install with a package manager, so most PHP developers are not affected. The risk is for anyone who hosts pearweb, runs a mirror or a fork, or copied code from it.
The category delete query uses the category id directly in SQL without parameterization, and the category manager page accepts that id from a POST request.
How to check if you're exposed
Check which version of pearweb you deploy. If you track it through git, look at the tag or commit you are on and compare it with 1.33.0.
git describe --tags
If you run a fork, search your own copy for the file and function named in the advisory, because a fork may not have received the fix.
What to do now
- Upgrade pearweb to 1.33.0 or later.
- If you run a fork, port the fix from 1.33.0 and review neighbouring code for the same pattern.
- Restrict access to the affected workflow until you have upgraded.
- Check your database and application logs for unusual requests to the affected page.
- Run a static analysis scan on the code base to find similar cases.
Why it matters
User input reached a SQL statement as text. Parameterized queries keep data and commands apart, and this code did not use one. The advisory rates it moderate while the NVD record scores 9.8. The weakness is CWE-89 (SQL Injection).
Six pearweb advisories were published on the same day, found by the same researchers. When one component has several flaws of the same type, it is a sign that the pattern is common in the code, so review beyond the single fix.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does it need a login?
The advisory says the attacker needs access to the category manager workflow. The NVD vector lists no privileges, so do not rely on the login alone.
Sources
Last reviewed: 19 October 2026.
