DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-81525: CVE-2026-81525: Cross-Tenant Database Retargeting via Dot and Null Injection in MongoDB PHP Driver

#security #cve #cybersecurity

CVE-2026-81525: Cross-Tenant Database Retargeting via Dot and Null Injection in MongoDB PHP Driver

Vulnerability ID: CVE-2026-81525
CVSS Score: 8.6
Published: 2026-09-08

A high-severity namespace injection vulnerability in both the MongoDB Client Library for PHP (mongodb/mongodb) and the native PHP C Extension (ext-mongodb) allows unauthenticated remote attackers to bypass logical database separation and execute database commands inside unauthorized storage compartments via dot (".") and null byte ("\0") injection.

TL;DR

Improper input validation in MongoDB's PHP libraries allows attackers to inject dot characters and null bytes into database and collection name parameters, silently retargeting database queries and writes to administrative or system collections.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-943: Improper Neutralization of Special Elements in Data Query Logic
  • Attack Vector: Network (AV:N)
  • CVSS v4.0 Score: 8.6 (High)
  • EPSS Score: 0.00273 (19.38th Percentile)
  • Impact: Logical Security Boundary Bypass / Multi-Tenant Retargeting
  • Exploit Status: Proof-of-Concept (PoC) Released
  • KEV Status: Not Listed

Affected Systems

  • MongoDB Client Library for PHP (mongodb/mongodb)
  • MongoDB PHP C Extension (ext-mongodb)
  • mongodb/mongodb: < 1.21.4 (Fixed in: 1.21.4)
  • mongodb/mongodb: >= 2.0.0, < 2.4.1 (Fixed in: 2.4.1)
  • ext-mongodb: < 1.21.6 (Fixed in: 1.21.6)
  • ext-mongodb: >= 2.0.0, < 2.4.1 (Fixed in: 2.4.1)

Code Analysis

Commit: 3a46221

Validate database and collection names in PHP Library constructors to prevent dot and null injection

Commit: 6f305a3

Implement centralized create_namespace helper for safe validation

Commit: f80ac47

Verify database names and namespaces in PHP C Driver extension using phongo_validate_dbname

Exploit Details

  • MongoDB Jira: Jira ticket tracking namespace validation issues and PoC behavior.

Mitigation Strategies

  • Upgrade MongoDB PHP Client Library to 1.21.4+ or 2.4.1+
  • Upgrade PHP C Extension (ext-mongodb) to 1.21.6+ or 2.4.1+
  • Validate and sanitize user-supplied database and collection identifiers using alphanumeric allowlists
  • Restrict application database user privileges to prevent access to administrative namespaces

Remediation Steps:

  1. Identify any database queries where database or collection identifiers are dynamically constructed from client input
  2. Update Composer dependencies to pull mongodb/mongodb version 1.21.4 or 2.4.1
  3. Upgrade the native PECL extension using: pecl install mongodb-1.21.6 (or 2.4.1)
  4. Implement local input validation utilizing str_contains() or regular expressions to reject dots and null bytes on old versions

References

Read the full report for CVE-2026-81525 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)