CVE-2026-81525: MongoDB PHP library namespace injection in database and collection names

CVE-2026-81525 · Severity: high · CVSS 8.1 · Published 2026-08-27

The MongoDB PHP library did not properly validate database and collection names, allowing attackers with low privileges to inject special characters (dots and NUL bytes) that cause operations to target unintended databases or collections. This could lead to unauthorized access to other tenants' data or modification of data in cross-tenant scenarios where multiple applications share a MongoDB instance.

Technologies: MongoDB PHP Library, mongodb/mongodb (Packagist). Vendors: MongoDB, Packagist.

Quick answers

Is CVE-2026-81525 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-81525 being exploited in the wild.
How severe is CVE-2026-81525?
High severity, with a CVSS score of 8.1, published 27 August 2026.
Which products and versions are affected?
MongoDB PHP Library < 1.21.4, >= 2.0.0 and < 2.4.1; mongodb/mongodb (Packagist) ECOSYSTEM:introduced=0,fixed=1.21.4.
Is there a fix for CVE-2026-81525?
Yes. mongodb/mongodb (Packagist): upgrade to 1.21.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81525 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-81525?
Check whether you run MongoDB PHP Library or mongodb/mongodb (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mongodb/mongodb (Packagist): upgrade to 1.21.4 or later
    composer require mongodb/mongodb:^1.21.4

Technical details

The vulnerability is an improper input validation (CWE-943) affecting the MongoDB PHP library's namespace handling. The library concatenates database and collection names into a namespace string but only validated that names were non-empty. A dot (.) in a database name or NUL byte in either a database or collection name shifts the namespace split performed by the MongoDB server, causing operations to target a different database or collection than intended. An attacker with low privileges can pass untrusted input as part of database or collection names through APIs like Find, Insert, Update, Delete, BulkWrite, or RenameCollection. The fix, available in versions 1.21.4 and 2.4.1, adds a create_namespace() helper function that validates both database and collection names and rejects dots in database names and NUL bytes in both types of names before concatenation.

Affected products

  • MongoDB PHP Library < 1.21.4, >= 2.0.0 and < 2.4.1

Identifiers

  • CVE-2026-81525
  • GHSA-65fr-j4p9-vc33

Timeline

  • 2026-08-27: disclosed
  • 2026-08-27: patched: Patches released for versions 1.21.4 and 2.4.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.