In short
- CVE-2026-81525 is a HIGH (CVSS 8.1) vulnerability affecting mongodb/mongodb, php driver (mongodb), php library (mongodb).
- Chance of exploitation in the next 30 days (EPSS): 0.49%, higher than 42.1% of all vulnerabilities.
- Fix: update to 2.4.1, 1.21.4, 1.21.6 or later.
| Package | Affected versions | Patched versions |
|---|
| mongodb/mongodb Packagist | ≥ 2.0.0, < 2.4.1< 1.21.4
| 2.4.11.21.4
|
| php driver | ≥ 2.0.0, < 2.4.1< 1.21.6
| 2.4.11.21.6
|
| php library | ≥ 2.0.0, < 2.4.1< 1.21.4
| 2.4.11.21.4
|
Description
Impact
Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified.
Patches
Fixed in PHP library 1.21.4 and 2.4.1.
Workarounds
Validate database and collection names prior to passing into APIs.
NVD description
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.
More vulnerabilities in mongodb/mongodb
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free