All vulnerabilities
CVE-2026-96745GHSA-cmvj-vxvq-rh2c

PHP object injection via unsuppressible __pclass class inference in command monitoring events

MongoDB PHP DriverRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.30%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.21.10Also 2.1.10, 2.5.3CVE List
Published24 Sep 2026Updated 24 Sep 2026CVE List

What fixes it

  • 1.21.10PHP DriverCVE List
  • 2.1.10PHP DriverCVE List
  • 2.5.3PHP DriverCVE List
  • 1.21.10mongodb/mongodb-extension, composerGitHubcomposer require "mongodb/mongodb-extension:^1.21.10"
  • 2.1.10mongodb/mongodb-extension, composerGitHubcomposer require "mongodb/mongodb-extension:^2.1.10"
  • 2.5.3mongodb/mongodb-extension, composerGitHubcomposer require "mongodb/mongodb-extension:^2.5.3"
Show all 9 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data in a database operation, an unauthenticated party who controls that data may cause an application class implementing the driver's persistable interface to be instantiated and its unserialization method invoked with the supplied data. The resulting impact depends on the classes available in the application.

Text from CVE List

Affected versions 9

  • PHP Driveraffected: all versions before 1.21.10CVE List
  • PHP Driveraffected: 2.0.0 before 2.1.10CVE List
  • PHP Driveraffected: 2.2.0 before 2.5.3CVE List
  • mongodb/mongodb-extension, composer< 1.21.10GitHub
  • mongodb/mongodb-extension, composer>= 2.0.0, < 2.1.10GitHub
  • mongodb/mongodb-extension, composer>= 2.2.0, < 2.5.3GitHub
  • mongodb, pecl< 1.21.10GitHub
  • mongodb, pecl>= 2.0.0, < 2.1.10GitHub
  • mongodb, pecl>= 2.2.0, < 2.5.3GitHub

References 5