Improper Data Query Handling in Laravel MongoDB Integration

CVE-2026-88022

What is CVE-2026-88022?

A vulnerability exists in the MongoDB integration for Laravel, where improper neutralization of special elements in data queries can allow an attacker to manipulate array inputs in a way that interprets them as query conditions instead of literal values. This flaw specifically impacts methods like the three-argument where with the operator = or eq, as well as the find and delete methods. An attacker able to exploit this vulnerability can potentially access unintended documents or delete documents beyond their intended scope.

References