CVE-2026-96745: PHP object injection via unsuppressible __pclass class inference in command monitoring events
Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data in a database operation, an unauthenticated party who controls that data may cause an application class implementing the driver's persistable interface to be instantiated and its unserialization method invoked with the supplied data. The resulting impact depends on the classes available in the application.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
Applications using the MongoDB PHP Driver are exposed when they register a command monitoring subscriber and include attacker-controlled data in a database operation. Exploitation also requires an application class that implements the driver’s persistable interface.
What does an attacker need to do?
An unauthenticated attacker must control data included in a database operation. Class names embedded in that document content can then be honored while the driver constructs command monitoring event objects, causing a matching application class to be instantiated and its unserialization method invoked.
What determines the practical impact?
The impact depends on the persistable classes available in the application and what their unserialization methods do with supplied data. The stated potential effects include loss of confidentiality, integrity, and availability.