This vulnerability arises from the MongoDB PHP Driver honoring class names embedded in document content during command monitoring event object construction. When an application registers a command monitoring subscriber and processes untrusted data, an attacker can trigger deserialization of arbitrary classes implementing the persistable interface. This can lead to unexpected code execution paths depending on the application’s class implementations. The affected versions are >=0 <1.21.10, >=2.0.0 <2.1.10, and >=2.2.0 <2.5.3. No known exploits are reported in the wild, and no official patch links are provided in the input data.

An unauthenticated attacker able to supply untrusted data in a database operation can cause the MongoDB PHP Driver to instantiate application classes and invoke their unserialization methods. This can lead to potential code execution or other impacts depending on the application’s classes that implement the persistable interface. The vulnerability is rated medium severity with a CVSS 4.0 score of 6.3, reflecting network attack vector but requiring high attack complexity and no privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid registering command monitoring subscribers that process untrusted data or sanitize inputs to prevent untrusted data from reaching the driver’s command monitoring feature. Monitor vendor channels for updates and apply patches promptly once released.