Vulnerability in MongoDB PHP Driver

[ Description ]Official description

Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data in a database operation, an unauthenticated party who controls that data may cause an application class implementing the driver's persistable interface to be instantiated and its unserialization method invoked with the supplied data. The resulting impact depends on the classes available in the application.

[ Fixes ]Fixes and patches

• Security bulletin: MongoDB GHSA-frjf-h5jg-4v46Vendor patch or bulletin · CERT-FR · github.com/mongodb/mongo-c-driver/security/advisories/GHSA-frjf-h5jg-4, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB GHSA-qx36-8mw2-4r3xVendor patch or bulletin · CERT-FR · github.com/mongodb/mongo-python-driver/security/advisories/GHSA-qx36-8, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB GHSA-vp6j-j7w5-5xjjVendor patch or bulletin · CERT-FR · github.com/mongodb/mongo-python-driver/security/advisories/GHSA-vp6j-j, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB 3579Vendor patch or bulletin · CERT-FR · github.com/mongodb/laravel-mongodb/pull/3579, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB v1.49.12Vendor patch or bulletin · CERT-FR · github.com/mongodb-js/compass/releases/tag/v1.49.12, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB GHSA-cmvj-vxvq-rh2cVendor patch or bulletin · CERT-FR · github.com/mongodb/mongo-php-driver/security/advisories/GHSA-cmvj-vxvq, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB GHSA-v4x9-3549-crwvVendor patch or bulletin · CERT-FR · github.com/mongodb/mongo-python-driver/security/advisories/GHSA-v4x9-3, cited by CERT-FR CERTFR-2026-AVI-1234

[ Advisories ]Government CERT advisories

• CERT-FR28 Sep 2026CERTFR-2026-AVI-1234

  Multiple vulnerabilities in MongoDB Translated from French

  Multiple vulnerabilities have been discovered in MongoDB. They allow an attacker to cause a breach of data integrity, a security policy bypass and a security problem not specified by the vendor.

  CVE-2026-96745CVE-2026-96748CVE-2026-96747+2 more CVEs
• BSI CERT-Bund24 Sep 2026WID-SEC-2026-3583

  MongoDB Treiber (Python Driver, PHP Driver, C Driver, Compass and Laravel): Multiple vulnerabilities Translated from German

  CVE-2026-96744CVE-2026-96745CVE-2026-96750+4 more CVEs

[ References ]References

• github.com/mongodb/mongo-php-driver/pull/2115
• github.com/mongodb/mongo-php-driver/releases/tag/1.21.10
• github.com/mongodb/mongo-php-driver/releases/tag/2.1.10
• github.com/mongodb/mongo-php-driver/releases/tag/2.5.3
• github.com/mongodb/mongo-php-driver/security/advisories/GHSA-cmvj-vxvq-rh2c