MONGODB/MONGODB · CVE-2026-88023 · Package
FIX → 2.4.2 · 1.21.5
The MongoDB PHP Library's GridFS component treats a caller-supplied structured file identifier as a query condition instead of a literal ID. An authenticated user who can influence that identifier can read stored files beyond their target, delete all file chunks in the bucket, or rename the wrong file.
first public Sep 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that pass file identifiers from an authenticated user into the MongoDB PHP Library's GridFS functions are exposed. Applications that only use GridFS with server-generated IDs, or that do not use GridFS, are not affected.
Not affected if no-gridfs, patched-version, server-generated-ids
Who cares composer, gridfs, mongodb, php
mongodb/mongodb in composer.lock; affected if below 1.21.5 on the 1.x line or below on the 2.x line.Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.
Fixed in 1.21.5 and 2.4.2.
Validate GridFS IDs.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
2.4.2downloadToStream, delete, rename) that take an ID from user input.Upgrade to 2.4.2 · 1.21.5
mongodb/mongodb 1.x: upgrade to 1.21.5mongodb/mongodb 2.x: upgrade to 2.4.2This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.