CVE-2026-81525

Name	CVE-2026-81525
Description	The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
php-mongodb (PTS)	bullseye	1.9.0+1.7.5-2	vulnerable
	bookworm	1.15.0+1.11.1+1.9.2+1.7.5-1	vulnerable
	trixie	2.0.0-1	vulnerable
	forky, sid	2.1.0-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
php-mongodb	source	(unstable)	(unfixed)

[trixie] - php-mongodb <no-dsa> (Minor issue)
https://jira.mongodb.org/browse/PHPLIB-1927