How severe is CVE-2026-25233?

CVE-2026-25233 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability high.

Is CVE-2026-25233 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-25233?

CVE-2026-25233 affects Pear Pearweb. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-25233?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2026-25233 have an EU (EUVD) identifier?

Yes. CVE-2026-25233 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-5202.

When was CVE-2026-25233 published?

CVE-2026-25233 was published on 2026-02-03 and last updated on 2026-06-17.

CVE-2026-25233

CVE-2026-25233 is a critical-severity vulnerability in Pear Pearweb with a CVSS 3.x base score of 9.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-783.

Key facts

Severity: Critical (CVSS 3.x base score 9.1)
CVSS v4: 7.1
EPSS exploit prediction: 0% (23rd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-5202
Weakness: CWE-783
Affected product: Pear Pearweb
Published: 2026-02-03
Last modified: 2026-06-17

Description

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, logic bug in the roadmap role check allows non-lead maintainers to create, update, or delete roadmaps. This issue has been patched in version 1.33.0.

Frequently asked questions

What is CVE-2026-25233?: PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, logic bug in the roadmap role check allows non-lead maintainers to create, update, or delete roadmaps. This issue has been patched in version 1.33.0.
How severe is CVE-2026-25233?: CVE-2026-25233 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability high.
Is CVE-2026-25233 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-25233?: CVE-2026-25233 affects Pear Pearweb. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-25233?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2026-25233 have an EU (EUVD) identifier?: Yes. CVE-2026-25233 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-5202.
When was CVE-2026-25233 published?: CVE-2026-25233 was published on 2026-02-03 and last updated on 2026-06-17.

References

https://github.com/pear/pearweb/security/advisories/GHSA-p92v-9j73-fxx3

Affected products (1)

cpe:2.3:a:pear:pearweb:*:*:*:*:*:*:*:*

More vulnerabilities in Pear Pearweb

CVE-2026-25241 — Critical (CVSS 9.8): PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, an unauthenticated…
CVE-2026-25240 — Critical (CVSS 9.8): PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection…
CVE-2026-25238 — Critical (CVSS 9.8): PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection…
CVE-2026-25237 — Critical (CVSS 9.8): PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, use of preg_replace()…
CVE-2026-25236 — Critical (CVSS 9.8): PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection risk…
CVE-2026-25234 — Critical (CVSS 9.8): PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection…

All CVEs affecting Pear Pearweb →

Other CWE-783 vulnerabilities

CVE-2024-20314 — High (CVSS 8.6): A vulnerability in the IPv4 Software-Defined Access (SD-Access) fabric edge node feature of Cisco IOS XE Software could…
CVE-2026-7270 — High (CVSS 7.8): An operator precedence bug in the kernel results in a scenario where a buffer overflow causes attacker-controlled data…
CVE-2024-34726 — High (CVSS 7.8): In PVRSRV_MMap of pvr_bridge_k.c, there is a possible arbitrary code execution due to a logic error in the code. This…
CVE-2024-34723 — High (CVSS 7.8): In onTransact of ParcelableListBinder.java , there is a possible way to steal mAllowlistToken to launch an app from…
CVE-2024-34720 — High (CVSS 7.8): In com_android_internal_os_ZygoteCommandBuffer_nativeForkRepeatedly of com_android_internal_os_ZygoteCommandBuffer.cpp,…
CVE-2024-31335 — High (CVSS 7.8): In DevmemIntChangeSparse2 of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in…

Browse all CWE-783 vulnerabilities →