mongodb: Reject "." and NUL bytes in database and collection names
### Impact Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified. ### Patches Fixed in PHP library 1.21.4 and 2.4.1. ### Workarounds Validate database and collection names prior to passing into APIs.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-81525US | — | — | ||
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.6WEB
- https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.7WEB
- https://github.com/mongodb/mongo-php-driver/releases/tag/2.4.1WEB
- https://github.com/mongodb/mongo-php-libraryPACKAGE
- https://github.com/mongodb/mongo-php-library/commit/3a462213bb4fd46efa58a1937b06b1b0553b67a7WEB
- https://github.com/mongodb/mongo-php-library/commit/6f305a3b21740080255a3093b12458274c7cc8caWEB
- https://github.com/mongodb/mongo-php-library/pull/1967WEB
- https://github.com/mongodb/mongo-php-library/pull/1968WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan