Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2026-81525

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB PHP Library

Default version status: unaffected

  • 0 to < 1.21.4affected
  • 2.0.0 to < 2.4.1affected

MongoDB PHP Extension

Default version status: unaffected

  • 0 to < 1.21.6affected
  • 2.0.0 to < 2.4.1affected

References