CVE-2026-81525: Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver
Impact Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified.
Patches Fixed in PHP library 1.21.4 and 2.4.1.
Workarounds Validate database and collection names prior to passing into APIs.
Other sources
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mongodb/mongodbto a version that resolves this vulnerability.Fixed in 2.4.1 - Upgrade
Upgrade
composer/mongodb/mongodbto a version that resolves this vulnerability.Fixed in 1.21.4 - Upgrade
Upgrade
MongoDB client library for PHPto a version that resolves this vulnerability.Fixed in 1.21.4 - Upgrade
Upgrade
MongoDB client library for PHPto a version that resolves this vulnerability.Fixed in 2.4.1 - Compensating control
Validate database and collection names prior to passing them into the MongoDB client library for PHP APIs, to avoid dot/NUL injection via untrusted namespace identifiers that can silently retarget operations to a different storage location.
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker needs network access and low-level privileges, with no user interaction required. The application must incorporate attacker-controlled text into namespace identifiers used by the PHP client library.
What is the practical impact for affected applications?
Database operations may be silently redirected to a storage location other than the one intended by the application. This can result in high-impact confidentiality and integrity consequences, while no availability impact is indicated.
How can I identify applications that may be exposed?
Review PHP applications using the MongoDB PHP Driver or MongoDB PHP library for code that builds database or collection namespace identifiers from request data or other untrusted input. Pay particular attention to namespace values that are not strictly validated before being passed to database operations.
What release information is available for remediation planning?
The provided references include MongoDB PHP Library release 2.4.1 and MongoDB PHP Driver release 1.21.7. Compare deployed components with those release references and review the associated release information before updating.