Description
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.
Published: 2026-08-27
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Database Access
Action: Patch Immediately
AI Analysis

Impact

The MongoDB PHP client library does not sanitize special characters in namespace identifiers that are built from user input. When an application concatenates untrusted text into a namespace string, database operations can silently target a different collection or namespace than intended, enabling an attacker to read or modify data belonging to another tenant.

Affected Systems

MongoDB PHP Extension and MongoDB PHP Library are exposed. All versions of the PHP driver and library that do not include the patch are vulnerable; the released safe versions are 1.21.6 or later for the driver and 1.21.4 or later for the library.

Risk and Exploitability

The CVSS score of 8.6 classifies this as high severity. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending a specially crafted request that contains a dot or NUL byte in the namespace string, causing the repository to execute operations against an unintended namespace. This can result in cross‑tenant data disclosure or modification.

Generated by OpenCVE AI on August 28, 2026 at 08:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the MongoDB PHP Driver to version 1.21.6 or later and the MongoDB PHP Library to version 1.21.4 or later, which include the fix for this issue.
  • Validate or sanitize any user‑supplied data before incorporating it into namespace identifiers; restrict to alphanumeric characters or enforce a whitelist of allowed patterns.
  • After applying the patch, test the application to confirm that database operations target the intended namespaces and that untrusted input no longer affects namespace construction.

Generated by OpenCVE AI on August 28, 2026 at 08:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-65fr-j4p9-vc33 mongodb: Reject "." and NUL bytes in database and collection names
History

Fri, 28 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Mongodb
Mongodb php Extension
Mongodb php Library
Vendors & Products Mongodb
Mongodb php Extension
Mongodb php Library

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.
Title Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver
Weaknesses CWE-943
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Mongodb Php Extension Php Library
cve-icon MITRE

Status: PUBLISHED

Assigner: mongodb

Published:

Updated: 2026-08-28T15:49:03.964Z

Reserved: 2026-08-26T22:14:05.297Z

Link: CVE-2026-81525

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-27T20:18:50.913

Modified: 2026-08-28T21:16:15.740

Link: CVE-2026-81525

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T16:13:57Z

Weaknesses
  • CWE-943

    Improper Neutralization of Special Elements in Data Query Logic