Deserialization Vulnerability in MongoDB PHP Driver Affects Fourth Party Applications

CVE-2026-96745

What is CVE-2026-96745?

The MongoDB PHP Driver contains a vulnerability that allows for the deserialization of untrusted data. This issue arises in the command monitoring support, where class names embedded within document content can be manipulated. When a command monitoring subscriber includes untrusted data in a database operation, an unauthenticated attacker can potentially exploit this flaw. Specifically, they may trigger the instantiation of an application class that implements the driver's persistable interface, invoking the unserialization method with supplied data. The consequences of this vulnerability depend on the specific classes present within the application, posing a significant risk to the application's integrity and security.

References