mongodb: Reject "." and NUL bytes in database and collection names
### Impact Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified. ### Patches Fixed in PHP library 1.21.4 and 2.4.1. ### Workarounds Validate database and collection names prior to passing into APIs.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-81525US | — | — | ||
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.6WEB
- https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.7WEB
- https://github.com/mongodb/mongo-php-driver/releases/tag/2.4.1WEB
- https://github.com/mongodb/mongo-php-libraryPACKAGE
- https://github.com/mongodb/mongo-php-library/commit/3a462213bb4fd46efa58a1937b06b1b0553b67a7WEB
- https://github.com/mongodb/mongo-php-library/commit/6f305a3b21740080255a3093b12458274c7cc8caWEB
- https://github.com/mongodb/mongo-php-library/pull/1967WEB
- https://github.com/mongodb/mongo-php-library/pull/1968WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan