CVE-2026-81525
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than intended.
Risk Assessment
This could lead to unintended writes or reads in the wrong location, potentially compromising data integrity or confidentiality.
Recommendation
Validate and sanitize namespace identifiers from untrusted sources, and update the library to a patched version.
Original NVD description (English source)
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.