What is the CVSS score of CVE-2026-25239?

CVE-2026-25239 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-25239?

A SQL injection vulnerability in PEAR framework versions before 1.33.0 could allow attackers to manipulate database queries through crafted filenames in the API documentation queue.

How to fix or mitigate CVE-2026-25239?

Within 24 hours: inventory all systems running PEAR and identify which are version 1.33.0 or earlier; disable or restrict access to apidoc queue functionality if possible. Within 7 days: implement input validation and WAF rules to sanitize filename parameters, and establish a timeline for upgrading PEAR to 1.33.0 or later once patches become available. Within 30 days: complete upgrade to patched PEAR version and validate remediation through security testing.

PHP CVE-2026-25239

HIGH

SQL Injection (CWE-89)

2026-02-03 security-advisories@github.com

PHP SQLi Pearweb

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 03, 2026 - 19:16 nvd

HIGH 7.5

DescriptionGitHub Advisory

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in apidoc queue insertion can allow query manipulation if an attacker can influence the inserted filename value. This issue has been patched in version 1.33.0.

AnalysisAI

SQL injection in PEAR's apidoc queue insertion allows unauthenticated remote attackers to manipulate database queries by controlling filename values, enabling unauthorized data modification. PEAR versions before 1.33.0 are affected, and no patch is currently available for affected deployments.

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects Pearweb. PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in apidoc queue insertion can allow query manipulation if an attacker can influence the inserted filename value. This issue has been patched in version 1.33.0.