CVE-2026-81525

The mongodb/mongodb PHP library, the official MongoDB abstraction layer for PHP distributed via Composer, failed to reject '.' (dot) and NUL bytes in database and collection names. If an application passes untrusted user input as part of a database or collection name, an attacker can craft a name containing these characters so that operations target a different database or collection than the one the application specified. Under the published CVSS 4.0 vector, an attacker with low privileges (i.e., valid MongoDB credentials) over the network could read or modify data in unintended namespaces. Any PHP application using the library before version 1.21.4 (1.x branch) or 2.4.1 (2.x branch) is affected, though only deployments that interpolate untrusted input into database or collection names are practically exploitable. There is no known public proof of concept, no in-the-wild exploitation, and EPSS estimates only about a 0.3% probability of exploitation within 30 days.

What to do: Upgrade the mongodb/mongodb Composer package to 1.21.4 or later on the 1.x branch, or 2.4.1 or later on the 2.x branch. As a workaround, validate and sanitize database and collection names before passing them into library APIs, rejecting '.' and NUL bytes. Audit code paths where user-supplied input is used in database or collection names to determine whether your deployment is practically exposed.