CVE-2026-25233
Critical · 9.1CVSS
9.1
EPSS
0.4%
Published
Feb 3, 2026
CISA due date
—
The record
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, logic bug in the roadmap role check allows non-lead maintainers to create, update, or delete roadmaps. This issue has been patched in version 1.33.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-7270 An operator precedence bug in the kernel results in a scenario where a buffer overflow… CWE-783
- GHSA-39q2-94rc-95cp DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation CWE-783
- CVE-2026-0209 Under certain administrative conditions, FlashArray Purity may apply snapshot retention… CWE-783