High severity8.1NVD Advisory· Published Aug 27, 2026· Updated Sep 29, 2026
CVE-2026-81525
CVE-2026-81525
Description
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
mongodb/mongodbPackagist | < 1.21.4 | 1.21.4 |
mongodb/mongodbPackagist | >= 2.0.0, < 2.4.1 | 2.4.1 |
Affected products
3(expand)+ 1 more
- (no CPE)
- (no CPE)
Patches
Vulnerability mechanics
References
13- github.com/advisories/GHSA-65fr-j4p9-vc33ghsaADVISORY
- jira.mongodb.org/browse/PHPLIB-1927nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-81525ghsaADVISORY
- github.com/mongodb/mongo-php-driver/releases/tag/1.21.6nvdProductRelease NotesWEB
- github.com/mongodb/mongo-php-driver/releases/tag/1.21.7ghsaWEB
- github.com/mongodb/mongo-php-driver/releases/tag/2.4.1nvdProductRelease NotesWEB
- github.com/mongodb/mongo-php-library/commit/3a462213bb4fd46efa58a1937b06b1b0553b67a7ghsaWEB
- github.com/mongodb/mongo-php-library/commit/6f305a3b21740080255a3093b12458274c7cc8caghsaWEB
- github.com/mongodb/mongo-php-library/pull/1967ghsaWEB
- github.com/mongodb/mongo-php-library/pull/1968ghsaWEB
- github.com/mongodb/mongo-php-library/releases/tag/1.21.4nvdProductRelease NotesWEB
- github.com/mongodb/mongo-php-library/releases/tag/2.4.1nvdProductRelease NotesWEB
- github.com/mongodb/mongo-php-library/security/advisories/GHSA-65fr-j4p9-vc33ghsaWEB
News mentions
1- MongoDB: 20 Vulnerabilities in BI Connector, Drivers Disclosed TogetherVypr Intelligence · Aug 28, 2026