Executive brief
The MongoDB PHP library did not properly validate database and collection names, allowing attackers with low privileges to inject special characters (dots and NUL bytes) that cause operations to target unintended databases or collections. This could lead to unauthorized access to other tenants' data or modification of data in cross-tenant scenarios where multiple applications share a MongoDB instance.
Technical details
The vulnerability is an improper input validation (CWE-943) affecting the MongoDB PHP library's namespace handling. The library concatenates database and collection names into a namespace string but only validated that names were non-empty. A dot (.) in a database name or NUL byte in either a database or collection name shifts the namespace split performed by the MongoDB server, causing operations to target a different database or collection than intended. An attacker with low privileges can pass untrusted input as part of database or collection names through APIs like Find, Insert, Update, Delete, BulkWrite, or RenameCollection. The fix, available in versions 1.21.4 and 2.4.1, adds a create_namespace() helper function that validates both database and collection names and rejects dots in database names and NUL bytes in both types of names before concatenation.
Affected products
- MongoDB PHP Library < 1.21.4, >= 2.0.0 and < 2.4.1
Timeline
- 2026-08-27: disclosed
- 2026-08-27: patched: Patches released for versions 1.21.4 and 2.4.1
References
- https://github.com/mongodb/mongo-php-library/security/advisories/GHSA-65fr-j4p9-vc33
- https://github.com/mongodb/mongo-php-library/pull/1967
- https://github.com/mongodb/mongo-php-library/pull/1968
- https://github.com/mongodb/mongo-php-library/commit/3a462213bb4fd46efa58a1937b06b1b0553b67a7
- https://github.com/mongodb/mongo-php-library/commit/6f305a3b21740080255a3093b12458274c7cc8ca