CVE-2026-81525

HighCVSS 8.1/10Last modified Sep 29, 2026

Description

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-943

Affected software

Vendor	Product	Versions
MongoDB	PHP Library	< 1.21.4; >= 2.0.0, < 2.4.1
MongoDB	PHP Extension	< 1.21.6; >= 2.0.0, < 2.4.1

References

https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.6Product, Release Notes
https://github.com/mongodb/mongo-php-driver/releases/tag/2.4.1Product, Release Notes
https://github.com/mongodb/mongo-php-library/releases/tag/1.21.4Product, Release Notes
https://github.com/mongodb/mongo-php-library/releases/tag/2.4.1Product, Release Notes
https://jira.mongodb.org/browse/PHPLIB-1927Vendor Advisory

Timeline

Published: Aug 27, 2026
Last modified: Sep 29, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-815266.5The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it CVE-2026-815276.5A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregatio CVE-2026-815285.4A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value CVE-2026-815297.1Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an ap CVE-2026-81539.8OS command injection in Dashboard Server interface in Universal Robots PolyScope versions prior to 5.25.1 allows unauthenticated attacker to CVE-2026-815305.6A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material CVE-2026-815316.9An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization rem CVE-2026-815328.8A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement who CVE-2026-815337.1An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unu CVE-2026-815348.8The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9 CVE-2026-815359.1In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwardin CVE-2026-815367.7IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML extern