CVE-2026-81525
High
Description
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.
SeverityHigh
CVSS8.1
Exploit probability—
Product
Mongodb Php Driver
PublishedAug 27, 2026
First seenAug 27, 2026
Weakness typeCWE-943CWE-943
How to fix
Update
- mongodb php_driver1.21.6, 2.4.1 or later
- mongodb php_library1.21.4, 2.4.1 or later
- mongodb/mongodb1.21.4, 2.4.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mongodb php_driver | v < 1.21.6, 2.0.0 ≤ v < 2.4.1 | 1.21.6, 2.4.1 |
| mongodb php_library | v < 1.21.4, 2.0.0 ≤ v < 2.4.1 | 1.21.4, 2.4.1 |
| mongodb/mongodbPackagist | v < 1.21.4, 2.0.0 ≤ v < 2.4.1 | 1.21.4, 2.4.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.