GitHub Advisoryadvisory · Packagist
GHSA-65fr-j4p9-vc33 mongodb: Reject "." and NUL bytes in database and collection names
HIGH
Official page ↗
- Aliases
- CVE-2026-81525
- Ecosystem
- Packagist
- Packages
- mongodb/mongodb
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-943
- Reviewed
- 2026-09-08
Affected packages
• Packagist mongodb/mongodb: < 1.21.4 → fixed in 1.21.4
• Packagist mongodb/mongodb: >= 2.0.0, < 2.4.1 → fixed in 2.4.1
Description
Impact
Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified.
Patches
Fixed in PHP library 1.21.4 and 2.4.1.
Workarounds
Validate database and collection names prior to passing into APIs.
Related
Alias · CVE (1)
- CVE-2026-81525 The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before… vulnerability
Weakness · CWE (1)
- CWE-943 Improper Neutralization of Special Elements in Data Query Logic weakness
References
- https://github.com/mongodb/mongo-php-library/security/advisories/GHSA-65fr-j4p9-vc33 web
- https://nvd.nist.gov/vuln/detail/CVE-2026-81525 advisory
- https://github.com/mongodb/mongo-php-library/pull/1967 web
- https://github.com/mongodb/mongo-php-library/pull/1968 web
- https://github.com/mongodb/mongo-php-library/commit/3a462213bb4fd46efa58a1937b06b1b0553b67a7 web
- https://github.com/mongodb/mongo-php-library/commit/6f305a3b21740080255a3093b12458274c7cc8ca web
- https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.6 web
- https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.7 web
- https://github.com/mongodb/mongo-php-driver/releases/tag/2.4.1 web
- https://github.com/mongodb/mongo-php-library package
- https://github.com/mongodb/mongo-php-library/releases/tag/1.21.4 web
- https://github.com/mongodb/mongo-php-library/releases/tag/2.4.1 web
- https://jira.mongodb.org/browse/PHPLIB-1927 web