The vulnerability arises when role filter arrays are directly interpolated into an IN(...) clause within the user::maintains() method of the PEAR framework. This flaw allows an attacker to inject crafted SQL code that can read, modify, or delete data in the underlying database, thereby compromising data confidentiality and integrity. The weakness is a classic injection flaw (CWE-89) identified in the source code prior to version 1.33.0.

The affected product is the PEAR distribution system, specifically versions prior to 1.33.0 of pearweb. Users running any older version of PEAR that includes the user::maintains() component are potentially exposed. The update to version 1.33.0 addresses the issue.

The CVSS score of 6.9 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed exploitation in the wild yet. The likely attack vector is through the web interface or API that submits role filter arrays, requiring the attacker to supply malicious input or influence user-controlled parameters. If exploited, an attacker could retrieve or alter sensitive database content. The high complexity of the injection may require some knowledge of the database schema.