Improper Data Query Logic in MongoDB GridFS Component - MongoDB

CVE-2026-88036

What is CVE-2026-88036?

The MongoDB C Driver's GridFS component is susceptible to improper neutralization of special elements in data query logic. This vulnerability enables an authenticated user to manipulate a structured file identifier, causing it to be wrongly interpreted as a query condition. As a consequence, this can result in unauthorized access to stored file content or even the deletion of all GridFS file chunks in the affected bucket, leading to significant data loss and making stored content unreadable.

References