CVE-2026-96745

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-96745

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96745.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-96745

Aliases

GHSA-cmvj-vxvq-rh2c

Downstream

Published

2026-09-24T15:51:16Z

Modified

2026-09-26T03:48:34Z

Severity

6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

PHP object injection via unsuppressible __pclass class inference in command monitoring events

Details

Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data in a database operation, an unauthenticated party who controls that data may cause an application class implementing the driver's persistable interface to be instantiated and its unserialization method invoked with the supplied data. The resulting impact depends on the classes available in the application.

Database specific

{
    "cna_assigner":  "mongodb",
    "cwe_ids":  [
        "CWE-502"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96745.json"
}

References

Affected packages

Git / github.com/mongodb/mongo-php-driver

Affected ranges

Type

GIT

Repo

https://github.com/mongodb/mongo-php-driver

Events

Introduced

5a7adc35edf11107e8266146413d69b83de33d3f

Introduced

c63f6f23f087a5c33d70e47539372f2d8e429343

Fixed

374de3b3f4243a2930955f272cbe339111c4ffe6

Fixed

7f3674eb6b6e7c5222f78687a78dc6dae4fcba6a

Fixed

3551aa91ec7662ec9f7baa62358b7cda8aa5ae08

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.21.10"
        },
        {
            "introduced":  "2.0.0"
        },
        {
            "fixed":  "2.1.10"
        },
        {
            "introduced":  "2.2.0"
        },
        {
            "fixed":  "2.5.3"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.1.0

0.1.1

0.1.2

0.1.3

0.1.4

0.1.5

0.2.0

0.3.0

0.3.1

0.4.0

0.4.1

0.5.0

0.5.1

0.6.0

0.6.1

0.6.2

0.6.3

1.*

1.0.0

1.0.0RC0

1.0.0alpha1

1.0.0alpha2

1.0.0beta1

1.0.0beta2

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.10.0alpha1

1.11.0

1.11.0alpha1

1.12.0

1.13.0

1.14.0

1.14.0beta1

1.15.0

1.17.0

1.18.0

1.2.0

1.2.0alpha1

1.2.0alpha2

1.2.0alpha3

1.2.1

1.2.2

1.2.3

1.21.0

1.21.1

1.21.2

1.21.4

1.21.5

1.21.6

1.21.7

1.21.8

1.21.9

1.3.0

1.3.0RC1

1.3.0beta1

1.3.0beta2

1.3.1

1.4.0RC1

1.4.0beta1

1.5.0

1.6.0RC1

1.6.0alpha1

1.6.0alpha2

1.6.0alpha3

2.*

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.7

2.1.8

2.1.9

2.2.0

2.5.0

2.5.1

2.5.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96745.json"