The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.

CVE-2026-81525 affects the MongoDB client library for PHP, which fails to sufficiently sanitize special elements in application-supplied namespace identifiers. When untrusted text is incorporated into these identifiers, database operations may be silently redirected to unintended storage locations. This represents a namespace injection vulnerability that could lead to data integrity issues or unauthorized data access. The flaw exists in both the mongo-php-driver and mongo-php-library components. Patches have been released in mongo-php-driver version 1.21.7 and mongo-php-library version 2.4.1. Applications accepting user-supplied input for database or collection names are most at risk. The vulnerability could allow attackers to manipulate which database collections are targeted by application operations.