CVE-2026-96745
MediumCVSS 5.6Summary
A deserialization vulnerability in the command monitoring support of the MongoDB PHP Driver can cause class names from document content to be honored when building monitoring events. An attacker controlling data in database operations may instantiate application classes implementing the persistable interface and invoke their unserialize method.
Risk Assessment
The impact depends on available classes, but could include remote code execution, privilege escalation, or other unauthorized actions, posing a serious security threat.
Recommendation
It is recommended to upgrade the MongoDB PHP Driver to a patched version and avoid processing untrusted data in database operations when a monitoring subscriber is registered.
Other vulnerabilities in MongoDB PHP Driver
See all- CVE-2026-84968Medium
An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents.
- CVE-2026-6811Medium
A stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.
Original NVD description (English source)
Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data in a database operation, an unauthenticated party who controls that data may cause an application class implementing the driver's persistable interface to be instantiated and its unserialization method invoked with the supplied data. The resulting impact depends on the classes available in the application.