What is CVE-2026-25235?

CVE-2026-25235 is a high-severity vulnerability in Pear Pearweb, classified under CWE-337. CVSS score: 7.5/10. Published 2026-02-03.

How severe is CVE-2026-25235?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Pear Pearweb

CVE-2026-25235

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, predictable verification hashes may allow attackers to guess verification tokens and potentially verify election account requests without aut…

EPSS: 0.003 (16.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Pear Pearweb — versions < 1.33.0

Weakness classification (CWE)

CWE-337

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2026-25235?: CVE-2026-25235 is a high-severity vulnerability in Pear Pearweb, classified under CWE-337. CVSS score: 7.5/10. Published 2026-02-03.
How severe is CVE-2026-25235?: High severity. CVSS v3 base score is 7.5 out of 10.