CVE-2026-25236: PEAR is Vulnerable to SQL Injection in Damblan_Karma IN() Query via Literal Substitution
Published Feb 3, 2026
·Updated
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection risk exists in karma queries due to unsafe literal substitution for an IN (...) list. This issue has been patched in version 1.33.0.
Affected Software
2 affected components
pear/pear<1.33.0
PEAR Pearweb<1.33.0
Event History
Feb 3, 2026
CVE Published
via MITRE·06:29 PM
Data Sourced
via MITRE·06:29 PM
DescriptionWeakness
Data Sourced
via NVD·07:16 PM
DescriptionSeverityWeaknessAffected Software
Jun 19, 58090
Event
via FIRST·03:58 PM
Frequently Asked Questions
1
What is the severity of CVE-2026-25236?
CVE-2026-25236 is classified as a high severity vulnerability due to the potential for SQL injection attacks.
2
How do I fix CVE-2026-25236?
To fix CVE-2026-25236, upgrade PEAR to version 1.33.0 or later.
3
What is the impact of CVE-2026-25236?
The impact of CVE-2026-25236 allows attackers to execute arbitrary SQL queries on the database.
4
Which versions of PEAR are affected by CVE-2026-25236?
Versions of PEAR prior to 1.33.0 are affected by CVE-2026-25236.
5
What coding practice led to CVE-2026-25236?
CVE-2026-25236 resulted from unsafe literal substitution in the IN(...) SQL queries.