{"uuid": "9239e7cf-386e-4b82-8fb5-872e76a90ec3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81525", "type": "seen", "source": "https://gist.github.com/alon710/5fa9ee3aa8e2d98c87b91ce0095db96e", "content": "# CVE-2026-81525: CVE-2026-81525: Cross-Tenant Database Retargeting via Dot and Null Injection in MongoDB PHP Driver\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-09-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-81525\n\n## Summary\nA high-severity namespace injection vulnerability in both the MongoDB Client Library for PHP (mongodb/mongodb) and the native PHP C Extension (ext-mongodb) allows unauthenticated remote attackers to bypass logical database separation and execute database commands inside unauthorized storage compartments via dot (\".\") and null byte (\"\\0\") injection.\n\n## TL;DR\nImproper input validation in MongoDB's PHP libraries allows attackers to inject dot characters and null bytes into database and collection name parameters, silently retargeting database queries and writes to administrative or system collections.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-943: Improper Neutralization of Special Elements in Data Query Logic\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 8.6 (High)\n- **EPSS Score**: 0.00273 (19.38th Percentile)\n- **Impact**: Logical Security Boundary Bypass / Multi-Tenant Retargeting\n- **Exploit Status**: Proof-of-Concept (PoC) Released\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- MongoDB Client Library for PHP (mongodb/mongodb)\n- MongoDB PHP C Extension (ext-mongodb)\n- **mongodb/mongodb**: < 1.21.4 (Fixed in: `1.21.4`)\n- **mongodb/mongodb**: >= 2.0.0, < 2.4.1 (Fixed in: `2.4.1`)\n- **ext-mongodb**: < 1.21.6 (Fixed in: `1.21.6`)\n- **ext-mongodb**: >= 2.0.0, < 2.4.1 (Fixed in: `2.4.1`)\n\n## Mitigation\n\n- Upgrade MongoDB PHP Client Library to 1.21.4+ or 2.4.1+\n- Upgrade PHP C Extension (ext-mongodb) to 1.21.6+ or 2.4.1+\n- Validate and sanitize user-supplied database and collection identifiers using alphanumeric allowlists\n- Restrict application database user privileges to prevent access to administrative namespaces\n\n**Remediation Steps:**\n1. Identify any database queries where database or collection identifiers are dynamically constructed from client input\n2. Update Composer dependencies to pull mongodb/mongodb version 1.21.4 or 2.4.1\n3. Upgrade the native PECL extension using: pecl install mongodb-1.21.6 (or 2.4.1)\n4. Implement local input validation utilizing str_contains() or regular expressions to reject dots and null bytes on old versions\n\n## References\n\n- [MongoDB JIRA PHPLIB-1927](https://jira.mongodb.org/browse/PHPLIB-1927)\n- [MongoDB PHP Library 1.21.4 Release](https://github.com/mongodb/mongo-php-library/releases/tag/1.21.4)\n- [MongoDB PHP Library 2.4.1 Release](https://github.com/mongodb/mongo-php-library/releases/tag/2.4.1)\n- [MongoDB PHP Driver 1.21.6 Release](https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.6)\n- [MongoDB PHP Driver 2.4.1 Release](https://github.com/mongodb/mongo-php-driver/releases/tag/2.4.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-81525) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-09T10:33:18.416562Z"}