Kurz gesagt
- CVE-2026-81525 ist eine Schwachstelle (HOCH (CVSS 8.1)) in mongodb/mongodb, php driver (mongodb), php library (mongodb).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.49%, höher als bei 42.1% aller Schwachstellen.
- Abhilfe: auf 2.4.1, 1.21.4, 1.21.6 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| mongodb/mongodb Packagist | ≥ 2.0.0, < 2.4.1< 1.21.4
| 2.4.11.21.4
|
| php driver | ≥ 2.0.0, < 2.4.1< 1.21.6
| 2.4.11.21.6
|
| php library | ≥ 2.0.0, < 2.4.1< 1.21.4
| 2.4.11.21.4
|
Description
Impact
Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified.
Patches
Fixed in PHP library 1.21.4 and 2.4.1.
Workarounds
Validate database and collection names prior to passing into APIs.
NVD description
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free