What is the CVSS score of CVE-2026-25233?

CVE-2026-25233 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-25233?

A critical vulnerability in PEAR PHP framework (CVE-2026-25233) allows unauthorized users to manipulate roadmap data, potentially compromising project planning integrity and data governance.

How to fix or mitigate CVE-2026-25233?

Within 24 hours: Identify all systems running PEAR and document current version inventory; restrict roadmap access to lead maintainers only through role-based access controls. Within 7 days: Implement network segmentation to limit roadmap service exposure and enable enhanced logging on roadmap modification activities. Within 30 days: Upgrade to PEAR 1.33.0 or later once available; conduct access audit to detect unauthorized roadmap modifications since vulnerability disclosure.

PHP CVE-2026-25233

CRITICAL

Operator Precedence Logic Error (CWE-783)

2026-02-03 security-advisories@github.com

PHP Pearweb

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 03, 2026 - 19:16 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, logic bug in the roadmap role check allows non-lead maintainers to create, update, or delete roadmaps. This issue has been patched in version 1.33.0.

AnalysisAI

PEAR PHP framework prior to 1.33.0 has a logic bug in the roadmap feature allowing unauthorized access through incorrect operator comparison.

Technical ContextAI

PEAR < 1.33.0 has a CWE-783 operator precedence logic error that creates an authentication bypass in the roadmap feature, allowing unauthorized users to access restricted functionality.

RemediationAI

Update PEAR to 1.33.0 or later.

More in PHP

View all

CVE-2012-1823 CRITICAL Act Now POC

9.8 May 11

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

CVE-2016-1555 CRITICAL Act Now POC

9.8 Apr 21

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear

CVE-2024-11680 CRITICAL Act Now POC

9.8 Nov 26

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C

CVE-2025-49113 CRITICAL Act Now POC

9.9 Jun 02

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au

CVE-2017-9841 CRITICAL Act Now POC

9.8 Jun 27

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c

CVE-2025-0108 HIGH Act Now POC

8.8 Feb 12

Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers

CVE-2021-25298 HIGH Act Now POC

8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re

CVE-2021-25296 HIGH Act Now POC

8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re

CVE-2013-4983 CRITICAL Emergency POC

10.0 Sep 10

The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows

CVE-2023-6553 CRITICAL Act Now POC

9.8 Dec 15

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1

CVE-2024-46506 CRITICAL Emergency POC

10.0 May 13

NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro

CVE-2024-8353 CRITICAL Act Now POC

9.8 Sep 28

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

Same weakness CWE-783 – Operator Precedence Logic Error

View all

CVE-2017-13322 CRITICAL

10.0

8.6

7.8

7.8

7.8

7.8

7.8

7.8

Back

PHP CVE-2026-25233

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in PHP

Same weakness CWE-783 – Operator Precedence Logic Error

Share

External POC / Exploit Code