MongoDB PHP Library vulnerabilities

2 CVEs affecting MongoDB PHP Library, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-88023, published 2026-09-10.

More from MongoDB.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-81525, published 2026-08-27. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database…
• CVE-2026-88023, published 2026-09-10. High severity, CVSS 8.3. EPSS: 0.3% chance of exploitation in the next 30 days. Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query…