A vulnerable version of PEAR’s apidoc queue management accepts an unescaped filename that is directly concatenated into a SQL statement, creating a classic SQL injection flaw (CWE-89). An attacker who can influence the filename sent to the insert operation may manipulate the SQL query, potentially gaining unauthorized data read or even write access depending on the underlying database privileges. The flaw remains before version 1.33.0 and was addressed by the vendor in that release.

The affectation targets the PEAR framework component known as Pearweb. All deployments using PEAR prior to the 1.33.0 release are susceptible; later releases contain the fix.

The vulnerability has a CVSS score of 8.2, indicating high severity, but its EPSS score is below 1%, suggesting a low probability of exploitation as of current data. The issue is not listed in CISA’s KEV catalog. Exploitation typically requires the ability to submit a crafted filename to the apidoc queue insertion endpoint, which is commonly exposed through web interfaces or API calls that accept user input without validation. Attackers would inject malicious SQL via the filename parameter, which the application then trusts and executes.