The vulnerability occurs when the Rust driver embeds a caller‑supplied database name without neutralizing special characters, allowing the identifier to contain multiple dots that redirect a write operation to an unintended namespace. An attacker who can influence the target identifier in the application may force the driver to apply writes to a different logical boundary, resulting in unauthorized modification of data belonging to another part of the deployment. The weakness is a form of path traversal in a database context.

The affected component is the MongoDB Rust Driver. The specific versions affected are not listed in the advisory, but the advisory references a release (v3.8.2) and indicates that the issue existed before that point. Any application that uses the driver and allows untrusted input to specify a database name is potentially impacted.

The CVSS score of 7.1 indicates a high severity. The EPSS score is not available, so no explicit exploitation probability is reported. The vulnerability is not listed in the CISA KEV catalog. Attackers require the ability to influence the database name supplied to the driver, which could be achieved through application logic or user input. Once such influence is possible, the driver will perform the write against the redirection target using the application’s credentials, providing the attacker with unintended access within the same deployment.