CVE-2026-25241: PEAR is Vulnerable to SQL Injection in /get/<package>/<version> Endpoint
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, an unauthenticated SQL injection in the /get/<package>/<version> endpoint allows remote attackers to execute arbitrary SQL via a crafted package version. This issue has been patched in version 1.33.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25241?
CVE-2026-25241 is considered a high severity vulnerability due to its potential for remote exploitation through SQL injection.
How do I fix CVE-2026-25241?
To fix CVE-2026-25241, update PEAR to version 1.33.0 or later to mitigate the SQL injection risk.
What components are affected by CVE-2026-25241?
CVE-2026-25241 affects all versions of PEAR prior to 1.33.0, particularly the /get/<package>/<version> endpoint.
Can CVE-2026-25241 be exploited remotely?
Yes, CVE-2026-25241 can be exploited remotely by unauthenticated attackers to execute arbitrary SQL commands.
What kind of attacks can be executed via CVE-2026-25241?
CVE-2026-25241 allows for SQL injection attacks which can lead to data leakage, manipulation, or complete database compromise.