Doctrine MongoDB ODM: Encrypted Fields Can Be Stored as Plain Text

Published as "EncryptedFieldsMapGenerator may silently omit encrypted fields when a document has embedded documents"

medium Doctrine · Last reviewed Nov 3, 2026

CVE: No CVE assigned
GHSA: None
Packagist: PKSA-cknr-8ckg-k248
Reported: Nov 3, 2026

Can store fields marked #[Encrypt] unencrypted in MongoDB collections that mix a class's own encrypted fields with encrypted embedded documents.

Affected and fixed versions

In doctrine/mongodb-odm. Find the row for the version you run, and update to the release next to it.

If you run	Update to	Support
2.12.0 – 2.17.2	2.17.3	Supported

Upgrade

Run the line for the branch you are on.

composer require doctrine/mongodb-odm:^2.17.3

What this means

Fields you marked with #[Encrypt] can end up stored as plain text in MongoDB, with no error or warning. Anyone who can read the database, its backups or its replicas without the encryption keys can read those fields. That undoes the point of MongoDB's Queryable Encryption, where the server should never see the plain text.

Who is affected

Apps on doctrine/mongodb-odm from 2.12.0 up to (not including) 2.17.3 that created encrypted collections with odm:schema:create or SchemaManager::createDocumentCollection(). The Doctrine advisory says a class is exposed when its encrypted fields come from more than one place: its own #[Encrypt] fields plus an embedded document with encrypted fields, or two or more embedded documents with encrypted fields. The list of fields to encrypt then silently lost some of them.

If all of a class's encrypted fields are declared in one place, such as only on the root document or only in one embedded document, you aren't affected.

What to do

Update to 2.17.3. The fix builds the complete field list. Updating alone isn't enough, because a collection's encryption settings can't be changed after it's created:

Compare each encrypted collection's encryptedFields option with what the fixed version generates.
Drop and recreate any collection that's missing fields, then move the data into it.
Treat values already stored as plain text as exposed, including copies in backups, snapshots and replicas.

Check your app with an agent

Paste this into a coding agent that can read your project, such as Claude Code, Codex or Amp. It checks your composer.lock against the versions above and tells you what to update, without changing anything.

Check whether the PHP project you have access to is affected by this security advisory, and tell me what to update. Do a read-only check: don't edit files, don't run composer update or composer require, and don't try to reproduce the flaw.

Advisory: Doctrine MongoDB ODM: Encrypted Fields Can Be Stored as Plain Text (PKSA-CKNR-8CKG-K248)
Details: https://phpnews.net/security/doctrine/pksa-cknr-8ckg-k248

Affected versions, as Composer constraints:
- doctrine/mongodb-odm: >=2.12.0,<2.17.3

Fixed releases on branches that still get security fixes:
- 2.12.0 – 2.17.2: update to 2.17.3

1. Find every composer.lock in the project outside vendor/ (a monorepo can have one per app) and read the installed version of each package above. Packages installed as dependencies of other packages count too.
2. Compare each installed version with its constraint: "|" separates alternative ranges, and "," means both bounds apply.
3. For each affected install, read "What this means" at https://phpnews.net/security/doctrine/pksa-cknr-8ckg-k248 and check whether the project meets the conditions it describes (a feature in use, a config value, a driver). Say which conditions you could check and which you couldn't.
4. Report a table: lock file | package | installed version | affected (yes, no or unknown) | conditions met (yes, no or unknown) | update to | evidence. For each affected package, give the command that would fix it, without running it: composer update <package> --with-dependencies when it is only installed as a dependency of another package, or composer require with the fixed version when composer.json requires it directly. If the installed version is on a branch with no fixed release listed, say it needs a move to a newer branch.

Sources

The project's advisory →

← All Doctrine advisories