CVE-2026-25241 is an unauthenticated SQL injection in PEAR's pearweb, rated critical at CVSS 9.8. A remote attacker can run arbitrary SQL through a crafted package version on the download endpoint. Versions before 1.33.0 are affected, and the fix is to upgrade to 1.33.0.
What's affected
- Product: PEAR pearweb, the web application behind the PEAR PHP package distribution system.
- Affected: versions before 1.33.0.
- Fixed: 1.33.0, according to the advisory.
- Vector: network, no authentication, no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
How to check if you're exposed
Most people never run pearweb. It is the server software that hosts a PEAR channel, so this mainly concerns anyone operating their own copy of it. If you do, check the deployed release against the advisory. For a Composer based checkout of the source, look at the tag or commit you deployed:
git -C /path/to/pearweb describe --tags
If you only install packages from pear.php.net as a client, the flaw sits on the server side and the advisory should be read to confirm what applies to you.
What to do now
- Upgrade pearweb to 1.33.0 or later.
- Review web server and database logs for unusual requests to the package download path, especially versions containing quotes or SQL keywords.
- Make sure the database account used by the application has only the privileges it needs.
- Put the endpoint behind a web application firewall rule as a stopgap while you patch, knowing it is not a fix.
- Re-run your dependency inventory so you know where else PEAR components are in use.
Why it matters
The cause is a classic injection flaw, CWE-89: a value taken from the URL, the package version, ends up inside a SQL statement without being safely parameterised. Because the endpoint needs no login, anyone who can reach it can try the request.
The class of bug is well understood and the cure is the same everywhere: prepared statements with bound parameters. Remote, unauthenticated, high impact on confidentiality, integrity and availability explains the 9.8 score. The record does not mark this CVE as exploited in the wild, and it is not in the CISA KEV catalogue.
Quick check
Does this affect me if I only install PEAR packages?
The advisory describes a flaw in the pearweb server application. Client side use of the pear command is not described as affected, but confirm against the advisory for your setup.
Sources
Last reviewed: 19 October 2026.
