In breve
- CVE-2026-81525 è una vulnerabilità ALTO (CVSS 8.1) che riguarda mongodb/mongodb, php driver (mongodb), php library (mongodb).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.49%, superiore al 42.1% delle vulnerabilità.
- Correzione: aggiornare a 2.4.1, 1.21.4, 1.21.6 o successiva.
| Package | Affected versions | Patched versions |
|---|
| mongodb/mongodb Packagist | ≥ 2.0.0, < 2.4.1< 1.21.4
| 2.4.11.21.4
|
| php driver | ≥ 2.0.0, < 2.4.1< 1.21.6
| 2.4.11.21.6
|
| php library | ≥ 2.0.0, < 2.4.1< 1.21.4
| 2.4.11.21.4
|
Description
Impact
Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified.
Patches
Fixed in PHP library 1.21.4 and 2.4.1.
Workarounds
Validate database and collection names prior to passing into APIs.
NVD description
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free