CVE-2026-25238 is a critical flaw (CVSS 9.8) in pearweb, the code behind the PEAR PHP package site. A SQL injection in bug subscription deletion may let an attacker inject SQL through a crafted email value. PEAR's pearweb 1.33.0 fixes it, so anyone who runs pearweb or a fork of it should upgrade.
What's affected
- Affected: pearweb before 1.33.0.
- Fixed in: 1.33.0.
This concerns the pearweb web application. It is not the PEAR library packages you install with a package manager, so most PHP developers are not affected. The risk is for anyone who hosts pearweb, runs a mirror or a fork, or copied code from it.
The advisory says the delete path for bug subscriptions builds its query from an email value without safe handling.
How to check if you're exposed
Check which version of pearweb you deploy. If you track it through git, look at the tag or commit you are on and compare it with 1.33.0.
git describe --tags
If you run a fork, search your own copy for the file and function named in the advisory, because a fork may not have received the fix.
What to do now
- Upgrade pearweb to 1.33.0 or later.
- If you run a fork, port the fix from 1.33.0 and review neighbouring code for the same pattern.
- Restrict access to the affected workflow until you have upgraded.
- Check your database and application logs for unusual requests to the affected page.
- Run a static analysis scan on the code base to find similar cases.
Why it matters
An email address looks harmless, but it is still free text from the user. Treat every field as untrusted, whatever it is called. The weakness is CWE-89 (SQL Injection).
Six pearweb advisories were published on the same day, found by the same researchers. When one component has several flaws of the same type, it is a sign that the pattern is common in the code, so review beyond the single fix.
Quick check
Which input is affected?
The advisory names the email value used when deleting a bug subscription.
Sources
Last reviewed: 19 October 2026.
