CVE-2026-81525

Katalog CVE

CVSS 8.1 · High EPSS 0,49%

Kerentanan Improper Neutralization of Special Elements in Data Query Logic pada mongodb php driver, mongodb php library. Skor CVSS 3.1 8.1 (High) menurut mongodb.com.

Deskripsi (NVD)

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.

Advisory KUTIM-CSIRT

• Peringatan Keamanan: Rekapitulasi Enam Kerentanan pada Driver MongoDB 19 Sep 2026

Rincian

Terbit di NVD

27 Agustus 2026

Terakhir diubah

29 September 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber mongodb.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-943: Improper Neutralization of Special Elements in Data Query Logic

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://jira.mongodb.org/browse/PHPLIB-1927 advisory vendor
• https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.6 product · release notes
• https://github.com/mongodb/mongo-php-driver/releases/tag/2.4.1 product · release notes
• https://github.com/mongodb/mongo-php-library/releases/tag/1.21.4 product · release notes
• https://github.com/mongodb/mongo-php-library/releases/tag/2.4.1 product · release notes