{"id":"CVE-2026-81525","title":"The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations","summary":"The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporate…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-943"],"vendor":"mongodb","product":"php_driver","affected":["php_driver < 1.21.6","php_driver >= 2.0.0, < 2.4.1","php_library < 1.21.4","php_library >= 2.0.0, < 2.4.1"],"patched":["php_driver 2.4.1","php_library 2.4.1"],"published":"2026-08-27","updated":"2026-09-29","sourceUpdated":"2026-09-29T19:17:04.850","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81525","references":[{"url":"https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.6","label":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-php-driver/releases/tag/2.4.1","label":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-php-library/releases/tag/1.21.4","label":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-php-library/releases/tag/2.4.1","label":"cna@mongodb.com"},{"url":"https://jira.mongodb.org/browse/PHPLIB-1927","label":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-php-library/security/advisories/GHSA-65fr-j4p9-vc33"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81525"},{"url":"https://github.com/mongodb/mongo-php-library/pull/1967"},{"url":"https://github.com/mongodb/mongo-php-library/pull/1968"},{"url":"https://github.com/mongodb/mongo-php-library/commit/3a462213bb4fd46efa58a1937b06b1b0553b67a7"},{"url":"https://github.com/mongodb/mongo-php-library/commit/6f305a3b21740080255a3093b12458274c7cc8ca"},{"url":"https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.7"},{"url":"https://github.com/advisories/GHSA-65fr-j4p9-vc33"}],"tags":["nvd","ghsa","composer"],"epss":0.00489,"epssPercentile":0.41856,"aliases":["GHSA-65fr-j4p9-vc33"],"ecosystem":"composer","ingestedAt":"2026-09-08T22:12:30.968Z","slug":"CVE-2026-81525","body":"## Overview\n\nThe MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.\n\n## Affected\n\n- `php_driver < 1.21.6`\n- `php_driver >= 2.0.0, < 2.4.1`\n- `php_library < 1.21.4`\n- `php_library >= 2.0.0, < 2.4.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `php_driver 2.4.1`\n- `php_library 2.4.1`\n\n## Package advisory (CVE-2026-81525)\n\nAffected packages:\n\n- `mongodb/mongodb < 1.21.4`\n- `mongodb/mongodb >= 2.0.0, < 2.4.1`\n\nPatched in:\n\n- `mongodb/mongodb 1.21.4`\n- `mongodb/mongodb 2.4.1`\n\nSource: https://github.com/advisories/GHSA-65fr-j4p9-vc33","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}