CVE-2026-81525 - Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver
Brief
CVE ID : CVE-2026-81525
Published : Aug. 27, 2026, 8:18 p. m.
- 55 minutes ago
Description : The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.
Severity: 8.6
- HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...