Pear
CVE-2026-25233
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as non-lead maintainer
-
ExploitSend roadmap creation request
-
ExecutionBypass role validation logic
-
ImpactCreate/update/delete roadmap without authorization
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Operator precedence logic error
|
| Exploitation Conditions | PEAR framework versions prior to 1.33.0 with maintainer account access. Attacker requires valid credentials as non-lead maintainer to exploit the roadmap role check bypass. |
| Impact | CVSS 9.1 — PEAR is a widely-used PHP component framework. Logic bugs in authorization are often more reliable to exploit than memory corruption. |
| Exploit ScenarioDerived | An attacker crafts requests that exploit the operator precedence error to bypass authorization checks and access restricted roadmap data and functionality. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
PEAR PHP framework prior to 1.33.0 has a logic bug in the roadmap feature allowing unauthorized access through incorrect operator comparison.
Earlier versions of this analysis (1)
Logic bug in PEAR framework roadmap enables unauthorized access.
RemediationAI
Update PEAR to 1.33.0 or later.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PEAR < 1.33.0 has a CWE-783 operator precedence logic error that creates an authentication bypass in the roadmap feature, allowing unauthorized users to access restricted functionality.
Know when Pear gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, logic bug in the roadmap role check allows non-lead maintainers to create, update, or delete roadmaps. This issue has been patched in version 1.33.0.
Executive ViewAI
A critical vulnerability in PEAR PHP framework (CVE-2026-25233) allows unauthorized users to manipulate roadmap data, potentially compromising project planning integrity and data governance. Organizations using PEAR versions below 1.33.0 face immediate risk of unauthorized changes to critical infrastructure documentation and project timelines.
Disable roadmap functionality in PEAR if not operationally critical; implement Web Application Firewall (WAF) rules to restrict roadmap create/update/delete endpoints to whitelisted IP addresses and authenticated lead maintainers only; enforce database transaction logging and implement role-based access control (RBAC) at the application layer to prevent non-lead users from executing roadmap operations; monitor and alert on all roadmap modification attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)GitHub Advisory
PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenam
PEAR HTML_AJAX 0.3.0 through 0.5.7 has a PHP Object Injection Vulnerability in the PHP Serializer. Rated critical severi
PEAR PHP framework has a code execution vulnerability through unsafe use of preg_replace() that allows attackers to exec
PEAR PHP framework has a seventh SQL injection with higher EPSS (0.12%), indicating more active scanning for this partic
PEAR PHP framework has another SQL injection vulnerability prior to version 1.33.0, the sixth in a series of critical se
PEAR PHP framework prior to 1.33.0 has a fifth SQL injection vulnerability, part of a comprehensive security audit that
PEAR PHP framework has a second SQL injection vulnerability in a different code path, providing an alternate database co
PEAR PHP framework prior to 1.33.0 has a SQL injection vulnerability allowing attackers to extract data from the compone
Pearweb versions up to 1.33.0 contains a vulnerability that allows attackers to guess verification tokens and potentiall
SQL injection in PEAR's apidoc queue insertion allows unauthenticated remote attackers to manipulate database queries by
The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for
Exploit-DB