{"id":"CVE-2026-81525","aliases":["CLSA-2026-1790259386","DEBIAN-CVE-2026-81525","EUVD-2026-67209","GHSA-65fr-j4p9-vc33","UBUNTU-CVE-2026-81525"],"status":"published","title":"Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver","description":"The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.","severity":{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00489,"percentile":0.4253,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-943"],"published":"2026-08-27T18:32:26Z","modified":"2026-10-28T02:31:05Z","fixes":[{"ecosystem":"Packagist","package":"mongodb/mongodb","fixed_in":["1.21.4","2.4.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Packagist","package":"mongodb/mongodb","fixed_in":["1.9.0-p1+tuxcare"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"mongodb/mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"mongodb/mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.4.1"}]}]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"mongodb/mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.0"},{"fixed":"1.9.0-p1+tuxcare"}]}],"versions":["1.9.0"]},{"source":"osv","ecosystem":"Debian:12","package":"php-mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.0+1.11.1+1.9.2+1.7.5-1","1.19.3-1","1.19.4-2","1.19.4-3~exp2","1.19.4-3~exp3","1.19.4-3~exp4","1.20.0-1","1.20.1-1","1.21.0-1","2.0.0-1","2.1.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"php-mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0-1","2.1.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"php-mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0-1","2.1.0-1"]},{"source":"osv","ecosystem":"Packagist","package":"mongodb/mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4"}]}],"versions":["0.1.0","0.2.0","1.0.0","1.0.0-alpha1","1.0.0-beta1","1.0.0-beta2","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.1.0","1.1.0-alpha1","1.1.1","1.1.2","1.10.0","1.10.1","1.11.0","1.12.0","1.13.0","1.13.0-beta1","1.13.1","1.15.0","1.16.0","1.16.1","1.17.0","1.17.1","1.18.0","1.19.0","1.19.1","1.2.0","1.2.0-alpha1","1.20.0","1.21.0","1.21.1","1.21.2","1.21.3","1.3.0","1.3.1","1.3.2","1.4.0","1.4.1","1.4.2","1.4.3","1.5.0","1.5.1","1.5.2","1.6.0","1.6.1","1.7.0","1.7.0-beta1","1.7.0-beta2","1.7.0-rc1","1.7.1","1.7.2","1.8.0","1.8.0-RC1","1.9.0","1.9.0-alpha1"]},{"source":"osv","ecosystem":"Packagist","package":"mongodb/mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.4.1"}]}],"versions":["2.0.0","2.1.0","2.1.1","2.1.2","2.2.0","2.3.0","2.4.0"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"php-mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.2-2~ubuntu1","1.1.5-1~build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"php-mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.3-1build1","1.3.4-1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"php-mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.5-1build1","1.6.1-4","1.6.1-4build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"php-mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.0+1.7.5-2build2","1.11.1+1.9.2+1.7.5-4","1.12.0+1.9.2+1.7.5-3","1.12.0+1.9.2+1.7.5-4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"php-mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.0+1.11.1+1.9.2+1.7.5-1build1","1.15.0+1.11.1+1.9.2+1.7.5-1ubuntu1","1.15.0+1.11.1+1.9.2+1.7.5-1ubuntu2","1.15.0+1.11.1+1.9.2+1.7.5-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"php-mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.7-0ubuntu1","2.1.7-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"php-mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.0-1","2.1.7-0ubuntu1"]}],"products":[{"vendor":"mongodb","product":"php extension"},{"vendor":"mongodb","product":"php library"},{"vendor":"mongodb","product":"php_driver"},{"vendor":"mongodb","product":"php_library"}],"references":[{"url":"https://jira.mongodb.org/browse/PHPLIB-1927","tags":["Vendor Advisory","web","report"]},{"url":"https://github.com/mongodb/mongo-php-library/releases/tag/1.21.4","tags":["Product","Release Notes","web","report"]},{"url":"https://github.com/mongodb/mongo-php-library/releases/tag/2.4.1","tags":["Product","Release Notes","web","report"]},{"url":"https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.6","tags":["Product","Release Notes","web","report"]},{"url":"https://github.com/mongodb/mongo-php-driver/releases/tag/2.4.1","tags":["Product","Release Notes","web","report"]},{"url":"https://github.com/mongodb/mongo-php-library/security/advisories/GHSA-65fr-j4p9-vc33","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81525","tags":["advisory"]},{"url":"https://github.com/mongodb/mongo-php-library/pull/1967","tags":["web"]},{"url":"https://github.com/mongodb/mongo-php-library/pull/1968","tags":["web"]},{"url":"https://github.com/mongodb/mongo-php-library/commit/3a462213bb4fd46efa58a1937b06b1b0553b67a7","tags":["web"]},{"url":"https://github.com/mongodb/mongo-php-library/commit/6f305a3b21740080255a3093b12458274c7cc8ca","tags":["web"]},{"url":"https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.7","tags":["web"]},{"url":"https://github.com/advisories/GHSA-65fr-j4p9-vc33"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81525.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-81525","tags":["advisory"]},{"url":"https://github.com/mongodb/mongo-php-library","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-81525","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81525","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-81525","title":"Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver","description":"The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.","status":"published","published":"2026-08-27T18:32:26.493Z","modified":"2026-08-28T15:49:03.964Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-943"],"updated_at":"2026-11-02T13:36:18.075535Z"}],"euvd":[{"id":"EUVD-2026-67209","description":"The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.","status":"published","published":"2026-08-27T18:32:26Z","modified":"2026-08-28T15:49:03Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:23.104802Z"}],"ghsa":[{"id":"GHSA-65fr-j4p9-vc33","title":"mongodb: Reject \".\" and NUL bytes in database and collection names","description":"### Impact\nPassing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified.\n\n### Patches\nFixed in PHP library 1.21.4 and 2.4.1.\n\n### Workarounds\nValidate database and collection names prior to passing into APIs.","status":"published","published":"2026-09-08T21:27:42Z","modified":"2026-09-08T21:27:45Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-943"],"updated_at":"2026-11-02T14:41:14.764963Z"}],"nvd":[{"id":"CVE-2026-81525","description":"The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.","status":"published","published":"2026-08-27T20:18:50.913Z","modified":"2026-09-29T19:17:04.85Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-943"],"updated_at":"2026-11-02T14:12:42.035353Z"}],"osv":[{"id":"CVE-2026-81525","title":"Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver","description":"The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.","status":"published","published":"2026-08-27T18:32:26.493Z","modified":"2026-10-28T02:31:05.080117823Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-943"],"updated_at":"2026-11-02T15:45:18.131258Z"},{"id":"DEBIAN-CVE-2026-81525","description":"The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.","status":"published","published":"2026-08-27T20:18:50.913Z","modified":"2026-09-01T20:06:48.28595413Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:04.577397Z"},{"id":"GHSA-65fr-j4p9-vc33","title":"mongodb: Reject \".\" and NUL bytes in database and collection names","description":"### Impact\nPassing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified.\n\n### Patches\nFixed in PHP library 1.21.4 and 2.4.1.\n\n### Workarounds\nValidate database and collection names prior to passing into APIs.","status":"published","published":"2026-09-08T21:27:42Z","modified":"2026-09-08T21:56:03.177835Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-943"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"UBUNTU-CVE-2026-81525","description":"The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.","status":"published","published":"2026-08-27T20:18:00Z","modified":"2026-10-17T13:01:10.433476083Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:57:22.213888Z"},{"id":"CLSA-2026-1790259386","title":"TuxCare security update for mongodb/mongodb (1 CVE)","description":"TuxCare rebuilt mongodb/mongodb to address 1 CVE. Fixed in 1.9.0-p1+tuxcare.","status":"published","published":"2026-09-24T14:16:26Z","modified":"2026-10-15T09:48:04.668521365Z","updated_at":"2026-11-02T15:43:48.28229Z"}]}}