CVE-2026-25233
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, logic bug in the roadmap role check allows non-lead maintainers to create, update, or delete roadmaps. This issue has been patched in version 1.33.0.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.1
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.32%
- CWE
- CWE-783
- Published
- 2026-02-03
- Last modified
- 2026-03-12
Affected products
- pear pearweb
Weakness type
Related vulnerabilities
- CVE-2026-7270 — Local privilege escalation via execve()
- CVE-2026-0209 — Under certain administrative conditions, FlashArray Purity may apply snapshot retention policies...
- CVE-2025-27512 — Zincati allows unprivileged access to rpm-ostree D-Bus `Deploy()` and `FinalizeDeployment()` methods
- CVE-2024-20480 — A vulnerability in the DHCP Snooping feature of Cisco IOS XE Software on Software-Defined Access...
- CVE-2024-20314 — A vulnerability in the IPv4 Software-Defined Access (SD-Access) fabric edge node feature of Cisco...