Deserialization of untrusted data is used by the MongoDB PHP Driver to create command monitoring event objects. An attacker can embed a class name in the document data that is being sent to the database. Because the driver does not suppress __pclass inference for monitoring events, the class name is honored and the application class that implements the driver's persistable interface is instantiated. If that class performs operations during unserialization, the attacker may cause unintended code execution. The impact depends on the classes available in the application and could include code execution if the unserialization method performs critical actions.

MongoDB PHP Driver, versions prior to 1.21.10, 2.1.10, or 2.5.3 may be vulnerable.

CVSS score 6.3 indicates moderate severity. EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so current exploitation likelihood is uncertain. The vulnerability is triggered when an application registers a command monitoring subscriber and includes untrusted document content in a database operation; an unauthenticated actor who can influence that content may cause the driver to instantiate a class from the application code base. Attack requires only the ability to inject data into the database operation, making the vector likely local or remote depending on how the application accepts input. Because the weakness is a deserialization flaw (CWE-502), exploitation may be easier if the application contains a class that implements the persistable interface and executes meaningful code during unserialization.