high8.1
CVE-2026-81525
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct…
Impact
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | mongodb/mongodb | < 1.21.4 | 1.21.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mongodb | Php Driver | before 1.21.6 from 2.0.0 before 2.4.1 |
| Mongodb | Php Library | before 1.21.4 from 2.0.0 before 2.4.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-65fr-j4p9-vc33
- https://github.com/mongodb/mongo-php-library/security/advisories/GHSA-65fr-j4p9-vc33
- https://nvd.nist.gov/vuln/detail/CVE-2026-81525
- https://github.com/mongodb/mongo-php-library/pull/1967
- https://github.com/mongodb/mongo-php-library/pull/1968
- https://github.com/mongodb/mongo-php-library/commit/3a462213bb4fd46efa58a1937b06b1b0553b67a7
- https://github.com/mongodb/mongo-php-library/commit/6f305a3b21740080255a3093b12458274c7cc8ca
- https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.6
- https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.7
- https://github.com/mongodb/mongo-php-driver/releases/tag/2.4.1
- https://github.com/mongodb/mongo-php-library/releases/tag/1.21.4
- https://github.com/mongodb/mongo-php-library/releases/tag/2.4.1
- https://jira.mongodb.org/browse/PHPLIB-1927