要点
- CVE-2026-81525 是影响 mongodb/mongodb, php driver (mongodb), php library (mongodb) 的高危 (CVSS 8.1)漏洞。
- 未来 30 天内被利用的概率（EPSS）：0.49%，高于 42.1% 的漏洞。
- 修复：升级到 2.4.1, 1.21.4, 1.21.6 或更高版本。
| Package | Affected versions | Patched versions |
|---|
| mongodb/mongodb Packagist | ≥ 2.0.0, < 2.4.1< 1.21.4
| 2.4.11.21.4
|
| php driver | ≥ 2.0.0, < 2.4.1< 1.21.6
| 2.4.11.21.6
|
| php library | ≥ 2.0.0, < 2.4.1< 1.21.4
| 2.4.11.21.4
|
Description
Impact
Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified.
Patches
Fixed in PHP library 1.21.4 and 2.4.1.
Workarounds
Validate database and collection names prior to passing into APIs.
NVD description
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free