CVE-2026-81525
Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.
- Record
CVE-2026-81525- CVSS 4.0
- 8.6 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-943
- Updated
- 2026-11-02
EUVDEUVD-2026-67209
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.
- Record
EUVD-2026-67209- CVSS 4.0
- 8.6 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-65fr-j4p9-vc33
mongodb: Reject "." and NUL bytes in database and collection names
Impact
Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified.
Patches
Fixed in PHP library 1.21.4 and 2.4.1.
Workarounds
Validate database and collection names prior to passing into APIs.
- Record
GHSA-65fr-j4p9-vc33- CVSS 4.0
- 8.6 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-943
- Updated
- 2026-11-02
NVD
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.
- Record
CVE-2026-81525- CVSS 4.0
- 8.6 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-943
- Updated
- 2026-11-02
OSV
Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.
- Record
CVE-2026-81525- CVSS 4.0
- 8.6 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-943
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-81525
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.
- Record
DEBIAN-CVE-2026-81525- CVSS 4.0
- 8.6 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVGHSA-65fr-j4p9-vc33
mongodb: Reject "." and NUL bytes in database and collection names
Impact
Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified.
Patches
Fixed in PHP library 1.21.4 and 2.4.1.
Workarounds
Validate database and collection names prior to passing into APIs.
- Record
GHSA-65fr-j4p9-vc33- CVSS 4.0
- 8.6 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-943
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-81525
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.
- Record
UBUNTU-CVE-2026-81525- CVSS 4.0
- 8.6 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1790259386 No score
TuxCare security update for mongodb/mongodb (1 CVE)
TuxCare rebuilt mongodb/mongodb to address 1 CVE. Fixed in 1.9.0-p1+tuxcare.
- Record
CLSA-2026-1790259386- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mongodb/mongodbPackagist |
before 1.21.4 | 1.21.4 |
mongodb/mongodbPackagist |
2.0.0 up to 2.4.1 | 2.4.1 |
mongodb/mongodbTuxCare:Packagist |
1.9.0 up to 1.9.0-p1+tuxcare | 1.9.0-p1+tuxcare |
php-mongodbDebian:12 |
All versions, plus listed versions 1.15.0+1.11.1+1.9.2+1.7.5-11.19.3-11.19.4-21.19.4-3~exp21.19.4-3~exp3 Show 6 moreShow less1.19.4-3~exp41.20.0-11.20.1-11.21.0-12.0.0-12.1.0-1 |
None known |
php-mongodbDebian:13 |
All versions, plus listed versions 2.0.0-12.1.0-1 |
None known |
php-mongodbDebian:14 |
All versions, plus listed versions 2.0.0-12.1.0-1 |
None known |
mongodb/mongodbPackagist |
before 1.21.4, plus listed versions 0.1.00.2.01.0.01.0.0-alpha11.0.0-beta1 Show 45 moreShow less1.0.0-beta21.0.11.0.21.0.31.0.41.0.51.1.01.1.0-alpha11.1.11.1.21.10.01.10.11.11.01.12.01.13.01.13.0-beta11.13.11.15.01.16.01.16.11.17.01.17.11.18.01.19.01.19.11.2.01.2.0-alpha11.20.01.21.01.21.11.21.21.21.31.3.01.3.11.3.21.4.01.4.11.4.21.4.31.5.01.5.11.5.21.6.01.6.11.7.0 |
1.21.4 |
mongodb/mongodbPackagist |
2.0.0 up to 2.4.1, plus listed versions 2.1.02.1.12.1.22.2.02.3.02.4.0 |
2.4.1 |
php-mongodbUbuntu:16.04:LTS |
All versions, plus listed versions 1.1.2-2~ubuntu11.1.5-1~build1 |
None known |
php-mongodbUbuntu:18.04:LTS |
All versions, plus listed versions 1.2.3-1build11.3.4-1build1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
php-mongodbUbuntu:20.04:LTS |
All versions, plus listed versions 1.5.5-1build11.6.1-41.6.1-4build1 |
None known |
php-mongodbUbuntu:22.04:LTS |
All versions, plus listed versions 1.9.0+1.7.5-2build21.11.1+1.9.2+1.7.5-41.12.0+1.9.2+1.7.5-31.12.0+1.9.2+1.7.5-4 |
None known |
php-mongodbUbuntu:24.04:LTS |
All versions, plus listed versions 1.15.0+1.11.1+1.9.2+1.7.5-1build11.15.0+1.11.1+1.9.2+1.7.5-1ubuntu11.15.0+1.11.1+1.9.2+1.7.5-1ubuntu21.15.0+1.11.1+1.9.2+1.7.5-1ubuntu3 |
None known |
php-mongodbUbuntu:26.10 |
All versions, plus listed versions 2.1.7-0ubuntu12.1.7-0ubuntu2 |
None known |
php-mongodbUbuntu:26.04:LTS |
All versions, plus listed versions 2.1.0-12.1.7-0ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-81525 is a high vulnerability (CVSS 8.6) in Mongodb Php Driver, published August 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in mongodb/mongodb 1.21.4.
References
jira.mongodb.org/browse/PHPLIB-1927
github.com/mongodb/mongo-php-library/releases/tag/1.21.4
Show 12 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-81525
security-tracker.debian.org/tracker/CVE-2026-81525
ubuntu.com/security/CVE-2026-81525
cve.org/CVERecord?id=CVE-2026-81525
Left out here: 9 versions. The JSON record has them.