CVE-2026-25241: Pear Pearweb SQLi Vulnerability

CVE-2026-25241 Overview

CVE-2026-25241 is a critical SQL Injection vulnerability affecting PEAR pearweb, the framework and distribution system for reusable PHP components. Prior to version 1.33.0, an unauthenticated SQL injection in the /get/<package>/<version> endpoint allows remote attackers to execute arbitrary SQL via a crafted package version. This vulnerability poses a severe risk to organizations hosting PEAR package repositories, as attackers can potentially access, modify, or delete database contents without authentication.

Critical Impact

Unauthenticated remote attackers can execute arbitrary SQL commands against the backend database, potentially leading to complete database compromise, data exfiltration, and unauthorized access to sensitive package information.

Affected Products

• PEAR pearweb versions prior to 1.33.0

Discovery Timeline

• 2026-02-03 - CVE CVE-2026-25241 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-25241

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) exists in the PEAR pearweb package retrieval endpoint. The vulnerability occurs because user-supplied input in the version parameter is not properly sanitized before being incorporated into SQL queries. This allows attackers to inject malicious SQL statements that are then executed by the database server with the privileges of the application's database user.

The unauthenticated nature of this vulnerability significantly increases its risk profile. Any remote attacker with network access to the affected endpoint can exploit this flaw without requiring any credentials or prior authentication. Successful exploitation could lead to unauthorized access to the entire package database, manipulation of package metadata, injection of malicious packages, or complete database compromise depending on the database user privileges.

Root Cause

The root cause of this vulnerability is improper input validation and lack of parameterized queries in the version handling logic of the /get/<package>/<version> endpoint. When processing package version requests, the application directly concatenates user-supplied version strings into SQL queries without proper sanitization or use of prepared statements, creating a classic SQL injection attack surface.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can craft malicious HTTP requests to the vulnerable /get/<package>/<version> endpoint, injecting SQL commands through the version parameter. The attack can be executed remotely against any internet-facing PEAR pearweb installation running a vulnerable version.

The vulnerability is exploited by manipulating the version parameter in the package retrieval URL. By injecting SQL syntax into this field, attackers can alter the intended query logic, extract sensitive data through UNION-based or error-based injection techniques, or modify database contents depending on the application's database permissions.

For technical details on the vulnerability mechanism, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-25241

Indicators of Compromise

• Unusual SQL error messages in application logs originating from the /get/ endpoint
• Requests to /get/<package>/<version> containing SQL syntax characters such as single quotes, semicolons, UNION keywords, or comment sequences
• Database audit logs showing unexpected queries or access patterns from the web application user
• Anomalous database response times indicating time-based blind SQL injection attempts

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in URL parameters
• Monitor application access logs for requests containing SQL injection signatures targeting the /get/ endpoint
• Implement database activity monitoring to detect anomalous query patterns or unauthorized data access
• Use SentinelOne Singularity platform to detect post-exploitation activities following successful SQL injection attacks

Monitoring Recommendations

• Enable detailed logging for all requests to the /get/<package>/<version> endpoint
• Configure alerting for SQL error messages or exceptions in application logs
• Monitor database query logs for unusual SELECT, UNION, or data manipulation statements
• Implement network monitoring to detect data exfiltration following potential database compromise

How to Mitigate CVE-2026-25241

Immediate Actions Required

• Upgrade PEAR pearweb to version 1.33.0 or later immediately
• If immediate patching is not possible, restrict network access to the vulnerable endpoint using firewall rules
• Review database access logs for signs of prior exploitation
• Consider taking the affected service offline until patching is complete if exposure risk is high

Patch Information

PEAR has released version 1.33.0 which addresses this SQL injection vulnerability. Organizations should update their pearweb installations to this version or later as soon as possible. The patch details are available in the GitHub Security Advisory.

Workarounds

• Implement a reverse proxy or WAF rule to block requests containing SQL injection patterns in the version parameter
• Restrict access to the /get/<package>/<version> endpoint to trusted IP addresses only
• Temporarily disable the affected endpoint if package download functionality can be suspended
• Apply network segmentation to limit the database server's exposure from the web application tier

# Example: Nginx configuration to block common SQL injection patterns
location ~ ^/get/ {
    if ($request_uri ~* "(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|;|'|\"|--)") {
        return 403;
    }
    # Normal proxy configuration continues
}