Unrated severityOSV Advisory· Published Feb 3, 2026· Updated Feb 4, 2026
PEAR is Vulnerable to SQL Injection in user::maintains() Role IN() Filter
CVE-2026-25240
Description
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability can occur in user::maintains() when role filters are provided as an array and interpolated into an IN (...) clause. This issue has been patched in version 1.33.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
1- github.com/pear/pearweb/security/advisories/GHSA-xw9g-5gr2-c44fmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.