CVE-2026-81525High· 8.1▾ TwilightThe MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporate…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.5%
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.
php_driver < 1.21.6php_driver >= 2.0.0, < 2.4.1php_library < 1.21.4php_library >= 2.0.0, < 2.4.1Upgrade past the affected range:
php_driver 2.4.1php_library 2.4.1Affected packages:
mongodb/mongodb < 1.21.4mongodb/mongodb >= 2.0.0, < 2.4.1Patched in:
mongodb/mongodb 1.21.4mongodb/mongodb 2.4.1Connected by shared product, vendor, weakness, or advisory.
GHSA-x6mc-fgjf-77r7Medium· 8.3Duplicate Advisory: GridFS data disclosure and deletion via query-operator injection in file IDs
CVE-2026-88023High· 8.3Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal ide…
CVE-2026-114648High· 7.6NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys
CVE-2026-114647Medium· 4.3NoSQL operator injection via unvalidated replacement document in findOneAndReplace
CVE-2026-114652Medium· 6.5Update operator injection via single-element list rewriting in the update builder
CVE-2026-106432Low· 3.6The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation