CVE-2026-81525: CWE-943: Improper Neutralization of Special Elements in Data Query Logic in MongoDB PHP Library

The MongoDB PHP client library fails to adequately neutralize special elements in application-supplied namespace identifiers before using them to construct target namespaces for database operations. This improper sanitization (CWE-943) allows an attacker who can influence these identifiers to cause operations to be executed against different storage locations than intended by the application. This can lead to data integrity issues or unauthorized data access within the database context. The vulnerability has a CVSS 4.0 base score of 8.6, indicating high severity, with network attack vector, low attack complexity, no privileges required, and high impact on confidentiality and integrity.

An attacker able to supply untrusted text into namespace identifiers may cause database operations to be silently redirected to unintended storage locations. This can result in unauthorized data manipulation or leakage within the MongoDB environment used by the PHP application. The impact affects confidentiality and integrity of data handled by the vulnerable library versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid incorporating untrusted input directly into namespace identifiers used by the MongoDB PHP library. Implement input validation and sanitization at the application level to prevent injection of special elements into namespace identifiers.