CVE-2026-25240: PEAR is Vulnerable to SQL Injection in user::maintains() Role IN() Filter
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability can occur in user::maintains() when role filters are provided as an array and interpolated into an IN (...) clause. This issue has been patched in version 1.33.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25240?
CVE-2026-25240 is classified as a medium severity vulnerability due to its potential for SQL injection exploits.
How do I fix CVE-2026-25240?
To fix CVE-2026-25240, upgrade PEAR to version 1.33.0 or later where the vulnerability has been patched.
What type of vulnerability is CVE-2026-25240?
CVE-2026-25240 is an SQL injection vulnerability affecting the user::maintains() function when role filters are mishandled.
Which versions of PEAR are affected by CVE-2026-25240?
CVE-2026-25240 affects all versions of PEAR prior to version 1.33.0.
What can attackers achieve with CVE-2026-25240?
Attackers can exploit CVE-2026-25240 to execute arbitrary SQL queries against the database, potentially compromising data security.