---
id: CVE-2026-81525
title: >-
  The MongoDB client library for PHP does not sufficiently sanitize special
  elements in application-supplied namespace identifiers before using them to
  construct the target namespace for database operations
summary: >-
  The MongoDB client library for PHP does not sufficiently sanitize special
  elements in application-supplied namespace identifiers before using them to
  construct the target namespace for database operations. An application that
  incorporate…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-943
vendor: mongodb
product: php_driver
affected:
  - php_driver < 1.21.6
  - 'php_driver >= 2.0.0, < 2.4.1'
  - php_library < 1.21.4
  - 'php_library >= 2.0.0, < 2.4.1'
patched:
  - php_driver 2.4.1
  - php_library 2.4.1
published: '2026-08-27'
updated: '2026-09-29'
sourceUpdated: '2026-09-29T19:17:04.850'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81525'
references:
  - url: 'https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.6'
    label: cna@mongodb.com
  - url: 'https://github.com/mongodb/mongo-php-driver/releases/tag/2.4.1'
    label: cna@mongodb.com
  - url: 'https://github.com/mongodb/mongo-php-library/releases/tag/1.21.4'
    label: cna@mongodb.com
  - url: 'https://github.com/mongodb/mongo-php-library/releases/tag/2.4.1'
    label: cna@mongodb.com
  - url: 'https://jira.mongodb.org/browse/PHPLIB-1927'
    label: cna@mongodb.com
  - url: >-
      https://github.com/mongodb/mongo-php-library/security/advisories/GHSA-65fr-j4p9-vc33
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81525'
  - url: 'https://github.com/mongodb/mongo-php-library/pull/1967'
  - url: 'https://github.com/mongodb/mongo-php-library/pull/1968'
  - url: >-
      https://github.com/mongodb/mongo-php-library/commit/3a462213bb4fd46efa58a1937b06b1b0553b67a7
  - url: >-
      https://github.com/mongodb/mongo-php-library/commit/6f305a3b21740080255a3093b12458274c7cc8ca
  - url: 'https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.7'
  - url: 'https://github.com/advisories/GHSA-65fr-j4p9-vc33'
tags:
  - nvd
  - ghsa
  - composer
epss: 0.00489
epssPercentile: 0.41856
aliases:
  - GHSA-65fr-j4p9-vc33
ecosystem: composer
ingestedAt: '2026-09-08T22:12:30.968Z'
---

## Overview

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.

## Affected

- `php_driver < 1.21.6`
- `php_driver >= 2.0.0, < 2.4.1`
- `php_library < 1.21.4`
- `php_library >= 2.0.0, < 2.4.1`

## Remediation

Upgrade past the affected range:

- `php_driver 2.4.1`
- `php_library 2.4.1`

## Package advisory (CVE-2026-81525)

Affected packages:

- `mongodb/mongodb < 1.21.4`
- `mongodb/mongodb >= 2.0.0, < 2.4.1`

Patched in:

- `mongodb/mongodb 1.21.4`
- `mongodb/mongodb 2.4.1`

Source: https://github.com/advisories/GHSA-65fr-j4p9-vc33