CVE-2026-81525: mongodb: Reject "." and NUL bytes in database and collection names
Impact Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified.
Patches Fixed in PHP library 1.21.4 and 2.4.1.
Workarounds Validate database and collection names prior to passing into APIs.
Other sources
mongodb: Reject "." and NUL bytes in database and collection names
— Packagist
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mongodb/mongodbto a version that resolves this vulnerability.Fixed in 2.4.1 - Upgrade
Upgrade
composer/mongodb/mongodbto a version that resolves this vulnerability.Fixed in 1.21.4 - Upgrade
Upgrade
MongoDB PHP Driverto a version that resolves this vulnerability.Fixed in 1.21.4 - Upgrade
Upgrade
MongoDB PHP Driverto a version that resolves this vulnerability.Fixed in 2.4.1 - Configuration
Validate database and collection names before passing them to APIs; reject "." and NUL bytes in these names.
MongoDB PHP Driver database and collection name validation = reject "." and NUL bytes
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker needs network access and low-level privileges, with no user interaction required. The application must incorporate attacker-controlled text into namespace identifiers used by the PHP client library.
What is the practical impact for affected applications?
Database operations may be silently redirected to a storage location other than the one intended by the application. This can result in high-impact confidentiality and integrity consequences, while no availability impact is indicated.
How can I identify applications that may be exposed?
Review PHP applications using the MongoDB PHP Driver or MongoDB PHP library for code that builds database or collection namespace identifiers from request data or other untrusted input. Pay particular attention to namespace values that are not strictly validated before being passed to database operations.
What release information is available for remediation planning?
The provided references include MongoDB PHP Library release 2.4.1 and MongoDB PHP Driver release 1.21.7. Compare deployed components with those release references and review the associated release information before updating.