CVE-2026-81525: Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker needs network access and low-level privileges, with no user interaction required. The application must incorporate attacker-controlled text into namespace identifiers used by the PHP client library.
What is the practical impact for affected applications?
Database operations may be silently redirected to a storage location other than the one intended by the application. This can result in high-impact confidentiality and integrity consequences, while no availability impact is indicated.
How can I identify applications that may be exposed?
Review PHP applications using the MongoDB PHP Driver or MongoDB PHP library for code that builds database or collection namespace identifiers from request data or other untrusted input. Pay particular attention to namespace values that are not strictly validated before being passed to database operations.
What release information is available for remediation planning?
The provided references include MongoDB PHP Library release 2.4.1 and MongoDB PHP Driver release 1.21.7. Compare deployed components with those release references and review the associated release information before updating.