Summary
mongodb: Reject "." and NUL bytes in database and collection names
Advisory details
Impact
Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified.
Patches
Fixed in PHP library 1.21.4 and 2.4.1.
Workarounds
Validate database and collection names prior to passing into APIs.
References
- https://github.com/advisories/GHSA-65fr-j4p9-vc33
- https://github.com/mongodb/mongo-php-library/security/advisories/GHSA-65fr-j4p9-vc33
- https://nvd.nist.gov/vuln/detail/CVE-2026-81525
- https://github.com/mongodb/mongo-php-library/pull/1967
- https://github.com/mongodb/mongo-php-library/pull/1968
- https://github.com/mongodb/mongo-php-library/commit/3a462213bb4fd46efa58a1937b06b1b0553b67a7
- https://github.com/mongodb/mongo-php-library/commit/6f305a3b21740080255a3093b12458274c7cc8ca
- https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.6
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-106119
LangChain: MongoDBChatMessageHistory query injection can allow cross-session access
- MEDIUMCVE-2026-60090
PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL
- HIGHCVE-2026-105675
Ghost: Invite Token Disclosure in Ghost Admin API
- MEDIUMCVE-2026-105681
Ghost: Authorization Bypass in Comments Feature
- MEDIUMCVE-2026-88029
pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods
- HIGHCVE-2026-96627
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)