Unrated
Withdrawn security advisory
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, predictable verification hashes may allow attackers to guess verification tokens and potentially verify election account requests without authorization. This issue has been patched in version 1.33.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- Not specified
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 16:37 UTC · Revision 1
Source evidence
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, predictable verification hashes may allow attackers to guess verification tokens and potentially verify election account requests without authorization. This issue has been patched in version 1.33.0.
osv:UBUNTU-CVE-2026-25235
php-pear
Fixed versions: Not specified
php-pear
Fixed versions: Not specified
php-pear
Fixed versions: Not specified
php-pear
Fixed versions: Not specified
php-pear
Fixed versions: Not specified
php-pear
Fixed versions: Not specified
Complete source record
{
"id": "6b0256d257132ead1a2243827c54b9252b587ea5d8fd8d418c5471b96b3d16de",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-25235",
"method": "structured",
"payload": {
"kind": "withdrawal",
"title": "UBUNTU-CVE-2026-25235",
"summary": "PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, predictable verification hashes may allow attackers to guess verification tokens and potentially verify election account requests without authorization. This issue has been patched in version 1.33.0.",
"evidence": "osv:UBUNTU-CVE-2026-25235",
"products": [
{
"name": {
"value": "php-pear",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:1.10.1+submodules+notgz-4",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.10.1+submodules+notgz-6",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.10.1+submodules+notgz-6ubuntu0.1",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.10.1+submodules+notgz-6ubuntu0.2",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.10.1+submodules+notgz-6ubuntu0.3",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.10.1+submodules+notgz-6ubuntu0.3+esm1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "php-pear",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:1.10.5+submodules+notgz-1",
"evidence": "/affected/1/versions"
},
{
"value": "1:1.10.5+submodules+notgz-1ubuntu1",
"evidence": "/affected/1/versions"
},
{
"value": "1:1.10.5+submodules+notgz-1ubuntu1.18.04.1",
"evidence": "/affected/1/versions"
},
{
"value": "1:1.10.5+submodules+notgz-1ubuntu1.18.04.2",
"evidence": "/affected/1/versions"
},
{
"value": "1:1.10.5+submodules+notgz-1ubuntu1.18.04.3",
"evidence": "/affected/1/versions"
},
{
"value": "1:1.10.5+submodules+notgz-1ubuntu1.18.04.4",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "php-pear",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:1.10.9+submodules+notgz-1",
"evidence": "/affected/2/versions"
},
{
"value": "1:1.10.9+submodules+notgz-1ubuntu0.20.04.1",
"evidence": "/affected/2/versions"
},
{
"value": "1:1.10.9+submodules+notgz-1ubuntu0.20.04.2",
"evidence": "/affected/2/versions"
},
{
"value": "1:1.10.9+submodules+notgz-1ubuntu0.20.04.3",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "php-pear",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:1.10.12+submodules+notgz+20210212-1ubuntu1",
"evidence": "/affected/3/versions"
},
{
"value": "1:1.10.12+submodules+notgz+20210212-1ubuntu3",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "php-pear",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:1.10.13+submodules+notgz+2022032202-2build1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "php-pear",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:1.10.13+submodules+notgz+2022032202-2build1",
"evidence": "/affected/5/versions"
},
{
"value": "1:1.10.16+submodules+notgz-3",
"evidence": "/affected/5/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2026-25235",
"aliases": [
"UBUNTU-CVE-2026-25235"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "php-pear",
"purl": "pkg:deb/ubuntu/php-pear?arch=source&distro=esm-infra%2Fxenial",
"ecosystem": "Ubuntu:Pro:16.04:LTS"
},
"versions": [
"1:1.10.1+submodules+notgz-4",
"1:1.10.1+submodules+notgz-6",
"1:1.10.1+submodules+notgz-6ubuntu0.1",
"1:1.10.1+submodules+notgz-6ubuntu0.2",
"1:1.10.1+submodules+notgz-6ubuntu0.3",
"1:1.10.1+submodules+notgz-6ubuntu0.3+esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-25235.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "php-pear",
"binary_version": "1:1.10.1+submodules+notgz-6ubuntu0.3+esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "php-pear",
"purl": "pkg:deb/ubuntu/php-pear?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"1:1.10.5+submodules+notgz-1",
"1:1.10.5+submodules+notgz-1ubuntu1",
"1:1.10.5+submodules+notgz-1ubuntu1.18.04.1",
"1:1.10.5+submodules+notgz-1ubuntu1.18.04.2",
"1:1.10.5+submodules+notgz-1ubuntu1.18.04.3",
"1:1.10.5+submodules+notgz-1ubuntu1.18.04.4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-25235.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "php-pear",
"binary_version": "1:1.10.5+submodules+notgz-1ubuntu1.18.04.4"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "php-pear",
"purl": "pkg:deb/ubuntu/php-pear?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"1:1.10.9+submodules+notgz-1",
"1:1.10.9+submodules+notgz-1ubuntu0.20.04.1",
"1:1.10.9+submodules+notgz-1ubuntu0.20.04.2",
"1:1.10.9+submodules+notgz-1ubuntu0.20.04.3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-25235.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "php-pear",
"binary_version": "1:1.10.9+submodules+notgz-1ubuntu0.20.04.3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "php-pear",
"purl": "pkg:deb/ubuntu/php-pear?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"1:1.10.12+submodules+notgz+20210212-1ubuntu1",
"1:1.10.12+submodules+notgz+20210212-1ubuntu3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-25235.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "php-pear",
"binary_version": "1:1.10.12+submodules+notgz+20210212-1ubuntu3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "php-pear",
"purl": "pkg:deb/ubuntu/php-pear?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"1:1.10.13+submodules+notgz+2022032202-2build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-25235.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "php-pear",
"binary_version": "1:1.10.13+submodules+notgz+2022032202-2build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "php-pear",
"purl": "pkg:deb/ubuntu/php-pear?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"1:1.10.13+submodules+notgz+2022032202-2build1",
"1:1.10.16+submodules+notgz-3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-25235.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "php-pear",
"binary_version": "1:1.10.16+submodules+notgz-3"
}
]
}
}
],
"modified": "2026-10-21T23:01:54.614864191Z",
"provider": "osv",
"upstream": [
"CVE-2026-25235"
],
"references": [
"https://ubuntu.com/security/CVE-2026-25235",
"https://www.cve.org/CVERecord?id=CVE-2026-25235",
"https://github.com/pear/pearweb/security/advisories/GHSA-477r-4cmw-3cgf"
]
},
"related_cves": [
{
"value": "CVE-2026-25235",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 401052,
"published_at": "2026-02-03T19:16:00+00:00"
}