CVE-2026-81525 — Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namesp…
Published: 2026-08-27 · CVSS: 8.6 · CVSS 4.0
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7