EUVD-2026-67209
GHSA-65fr-j4p9-vc33
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain application-level access
-
DeliverySupply crafted string containing '.' or NUL byte
-
ExploitApplication passes input to PHP library namespace construction
-
ExecutionLibrary fails to sanitize and constructs unintended namespace
-
PersistMongoDB operation silently targets wrong collection
-
ImpactRead or write unauthorized collection data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Query language parameterization
|
| Exploitation Conditions | Exploitation requires that the target PHP application incorporates untrusted or user-supplied text directly into MongoDB database or collection name strings passed to the PHP library, without prior rejection of '.' or NUL byte characters. Applications that construct all namespace identifiers from trusted, hard-coded internal values are not vulnerable regardless of library version. The CVSS 4.0 PR:L metric indicates that some level of application access is required; unauthenticated exploitation against default configurations is not confirmed from available data. The flaw is strictly limited to namespace identifier handling and does not affect MongoDB query operator fields or document content, so collections accessed by fully static naming logic remain unaffected. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N) yields a score of 8.6, driven by network accessibility, low attack complexity, and high confidentiality and integrity impact against the vulnerable system. PR:L indicates exploitation is not unauthenticated - the attacker must have some application-level access to supply input that flows into namespace construction. No EPSS data was provided in the input intelligence, and the vulnerability is not present in the CISA KEV catalog. No proof-of-concept code has been identified. The practical risk is conditional: applications that construct namespace identifiers from trusted, hard-coded values are entirely unaffected, which substantially limits the real-world attack surface. For applications that do pass user-controlled strings into namespace construction, the impact is severe - silent misdirection of reads and writes across collection boundaries undermines data isolation assumptions without raising exceptions. |
| Exploit ScenarioDerived | An attacker with low-level access to a web application - such as an authenticated tenant user - submits a crafted record identifier or category name containing a '.' character into a field that the PHP application uses to construct a MongoDB collection name. The MongoDB PHP Library, without sanitization, incorporates the '.' into the namespace string and silently directs the query or write to an adjacent collection, potentially exposing documents belonging to other tenants or application modules. No public exploit code has been identified, but the attack requires only knowledge of the flaw and the ability to supply text to a namespace-consuming endpoint. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 27, 2026
Namespace injection in the MongoDB PHP Library allows attackers with application-level access to silently redirect database operations to unintended collections or databases by supplying identifiers containing '.' or NUL byte characters. Applications using the MongoDB PHP Library before 2.4.1 or the MongoDB PHP Driver before 1.21.7 that incorporate untrusted text into namespace identifiers are affected, with high confidentiality and integrity risk confirmed by the CVSS 4.0 score of 8.6. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
RemediationAI
Upgrade the MongoDB PHP Library to version 2.4.1 or later using Composer: 'composer require mongodb/mongodb:2.4.1', as confirmed by the vendor release at https://github.com/mongodb/mongo-php-library/releases/tag/2.4.1. Simultaneously upgrade the underlying MongoDB PHP Driver extension to version 1.21.7 or later, following installation instructions at https://php.net/manual/en/mongodb.installation.php, per the release at https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.7. As a compensating control if patching cannot be applied immediately, validate all user-supplied strings at application input boundaries and reject or strip any '.' and NUL byte characters before they are passed to MongoDB namespace construction functions; note that application-level sanitization is brittle and should not be treated as a permanent substitute for the library fix, since future code paths may bypass it.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The MongoDB PHP Library and its underlying PHP Driver extension (CPE: cpe:2.3:a:mongodb:php_driver) construct MongoDB namespace identifiers in the format 'database.collection' when targeting storage operations. The library failed to reject '.' characters, which serve as the namespace delimiter in MongoDB, and NUL bytes, which may truncate strings at the C driver level. CWE-943 (Improper Neutralization of Special Elements in Data Query Logic) describes this class of flaw: by embedding a literal '.' into a user-supplied database or collection name, an attacker can traverse namespace boundaries and target an adjacent collection, while NUL byte injection can cause the driver to interpret a truncated string as the intended namespace. The fix, documented in PHPLIB-1927, explicitly validates and rejects these characters before namespace construction.
Know when MongoDB gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Network-reachable via application input with low complexity; PR:L because attacker must control input to namespace construction; scope unchanged as redirection stays within the same MongoDB instance with no availability impact.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
2DescriptionCVE.org
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.
Executive ViewAI
Versions of MongoDB PHP Library (before 2.4.1) and MongoDB PHP Driver (before 1.21.7) contain a namespace injection vulnerability that allows attackers to redirect database queries to unintended data stores, creating direct threats to data confidentiality and integrity. Any application accepting user input for database or collection selection-whether through API parameters, URL paths, or form fields-is at risk if running affected versions. Leadership should prioritize assessment and immediate compensating controls given the 8.6 CVSS severity and current unavailability of vendor patches.
Implement strict input validation on all namespace parameters to reject any value containing '.' or NUL bytes; maintain a whitelist of approved database and collection names and enforce pattern matching before query execution; use parameterized query construction patterns where supported; audit codebase for all locations where user input flows into namespace identifiers; strengthen database-level access controls and role-based permissions to minimize blast radius; deploy database activity monitoring to detect and alert on unusual namespace access patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
NoSQL injection exploits databases that don't use traditional SQL syntax-like MongoDB, CouchDB, or Redis-by manipulating queries through unsanitized user input.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Exploit-DB