CVE-2026-25240 is a critical flaw (CVSS 9.8) in pearweb, the code behind the PEAR PHP package site. A SQL injection in user::maintains() can occur when role filters arrive as an array and are placed into an IN clause. PEAR's pearweb 1.33.0 fixes it, so anyone who runs pearweb or a fork of it should upgrade.
What's affected
- Affected: pearweb before 1.33.0.
- Fixed in: 1.33.0.
This concerns the pearweb web application. It is not the PEAR library packages you install with a package manager, so most PHP developers are not affected. The risk is for anyone who hosts pearweb, runs a mirror or a fork, or copied code from it.
The advisory says the function joins role strings from an array into role IN (...) rather than binding parameters, so anyone who can influence a role string can inject SQL.
How to check if you're exposed
Check which version of pearweb you deploy. If you track it through git, look at the tag or commit you are on and compare it with 1.33.0.
git describe --tags
If you run a fork, search your own copy for the file and function named in the advisory, because a fork may not have received the fix.
What to do now
- Upgrade pearweb to 1.33.0 or later.
- If you run a fork, port the fix from 1.33.0 and review neighbouring code for the same pattern.
- Restrict access to the affected workflow until you have upgraded.
- Check your database and application logs for unusual requests to the affected page.
- Run a static analysis scan on the code base to find similar cases.
Why it matters
Code that takes an array and builds a list needs the same care as code that takes one string. The advisory rates it moderate because the attacker must influence a role string, while the NVD record scores 9.8. The weakness is CWE-89 (SQL Injection).
Six pearweb advisories were published on the same day, found by the same researchers. When one component has several flaws of the same type, it is a sign that the pattern is common in the code, so review beyond the single fix.
Quick check
When is it reachable?
When a caller can influence any role string passed to the function as an array.
Sources
Last reviewed: 19 October 2026.
