MongoDBGHSA-65fr-j4p9-vc33
Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver
High8.1CVE-2026-81525 · Published Aug 27, 2026
### Impact Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified. ### Patches Fixed in PHP library 1.21.4 and 2.4.1. ### Workarounds Validate database and collection names prior to passing into APIs. ### References https://jira.mongodb.org/browse/PHPLIB-1927
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mongodb/mongodb Product | < 1.21.4 | 1.21.4 |
| >= 2.0.0, < 2.4.1 | 2.4.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
More MongoDB advisories
All MongoDB| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 27 | NoSQL injection via array replacement bypassing update shape validation in driver write path | Medium5.4 | 3.11.1 |
| Aug 27 | NoSQL injection in LINQ pipeline translation | Medium6.5 | 3.11.1 |
| Aug 27 | KMS master key exposure via unredacted credential serialization in driver settings string | Medium5.6 | 3.11.1 |
| Aug 27 | Connection-option injection via unescaped settings in the canonical MongoDB URL builder | High7.1 | 3.11.1 |
| Aug 27 | Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite | High7.1 | 2.8.2 |
| Aug 27 | Cross-database write redirection via unvalidated dotted database name in bulk write namespaces | Medium6.5 | 3.8.2 |