요약
- CVE-2026-81525은(는) mongodb/mongodb, php driver (mongodb), php library (mongodb)에 영향을 주는 높음 (CVSS 8.1) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.49%, 전체 취약점의 42.1%보다 높음.
- 조치: 2.4.1, 1.21.4, 1.21.6 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| mongodb/mongodb Packagist | ≥ 2.0.0, < 2.4.1< 1.21.4
| 2.4.11.21.4
|
| php driver | ≥ 2.0.0, < 2.4.1< 1.21.6
| 2.4.11.21.6
|
| php library | ≥ 2.0.0, < 2.4.1< 1.21.4
| 2.4.11.21.4
|
Description
Impact
Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified.
Patches
Fixed in PHP library 1.21.4 and 2.4.1.
Workarounds
Validate database and collection names prior to passing into APIs.
NVD description
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free