{"id":"CVE-2026-88023","kind":"vulnerability","aliases":["CVE-2026-88023","GHSA-8fxw-fmj8-xp7j"],"related":[],"title":"MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs","description":"### Impact\nImproper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.\n\n\n### Patches\nFixed in 1.21.5 and 2.4.2.\n\n### Workarounds\nValidate GridFS IDs.\n\n### References\nhttps://jira.mongodb.org/browse/PHPLIB-1929","summary":"The MongoDB PHP Library's GridFS component treats a caller-supplied structured file identifier as a query condition instead of a literal ID. An authenticated user who can influence that identifier can read stored files beyond their target, delete all file chunks in the bucket, or rename the wrong file.","severity":"high","cvss":8.3,"epss":0.00326,"exploited":false,"exploited_at":null,"products":[{"name":"mongodb/mongodb","fixed":["1.21.5"],"affected":">= 1.1.0, < 1.21.5","ecosystem":"composer"},{"name":"mongodb/mongodb","fixed":["2.4.2"],"affected":">= 2.0.0, < 2.4.2","ecosystem":"composer"},{"name":"mongodb php library","fixed":["1.21.5"],"affected":">= 1.1.0, < 1.21.5","ecosystem":"vendor"},{"name":"mongodb php library","fixed":["2.4.2"],"affected":">= 2.0.0, < 2.4.2","ecosystem":"vendor"}],"ecosystems":["composer","vendor"],"tags":["composer","cwe-943","gridfs","mongodb","package","php"],"not_affected_if":["no-gridfs","patched-version","server-generated-ids"],"how_to_check":"- Check the locked version of `mongodb/mongodb` in `composer.lock`; affected if below `1.21.5` on the 1.x line or below `2.4.2` on the 2.x line.\n- Search application code for GridFS calls (`downloadToStream`, `delete`, `rename`) that take an ID from user input.","fix":"- `mongodb/mongodb` 1.x: upgrade to `1.21.5`\n- `mongodb/mongodb` 2.x: upgrade to `2.4.2`\n- Workaround stated by the advisory: validate GridFS IDs before use.","status":"open","published_at":"2026-09-10T18:18:12+00:00","first_seen_at":"2026-11-09T16:51:33+00:00","triaged_at":"2026-11-09T16:53:24+00:00","updated_at":"2026-11-09T16:57:34+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T16:53:24Z","model":"claude-haiku-5-5","output":{"fix":"- `mongodb/mongodb` 1.x: upgrade to `1.21.5`\n- `mongodb/mongodb` 2.x: upgrade to `2.4.2`\n- Workaround stated by the advisory: validate GridFS IDs before use.","reach":"network","title":"MongoDB PHP Library: GridFS file IDs allow reading or deleting other files","impact":"high","summary":"The MongoDB PHP Library's GridFS component treats a caller-supplied structured file identifier as a query condition instead of a literal ID. An authenticated user who can influence that identifier can read stored files beyond their target, delete all file chunks in the bucket, or rename the wrong file.","audience":"developers","category":"package","nicknames":[],"who_cares":["php","mongodb","gridfs","composer"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads other stored files or deletes all GridFS chunks in a bucket.","analyst_note":"","how_to_check":"- Check the locked version of `mongodb/mongodb` in `composer.lock`; affected if below `1.21.5` on the 1.x line or below `2.4.2` on the 2.x line.\n- Search application code for GridFS calls (`downloadToStream`, `delete`, `rename`) that take an ID from user input.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-gridfs","server-generated-ids","patched-version"],"who_is_affected":"Applications that pass file identifiers from an authenticated user into the MongoDB PHP Library's GridFS functions are exposed. Applications that only use GridFS with server-generated IDs, or that do not use GridFS, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000804,"input_tokens":4886,"output_tokens":631,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,24A '-88023':17A,25A '-943':36B '/browse/phplib-1929':201C '1.21.5':191C '2.4.2':193C '8fxw':20A 'affect':144C,163C,174C 'also':178C 'applic':145C 'authent':66B,134C 'beyond':77B,151C 'bucket':86B,164C 'caller':51B,115C 'caller-suppli':50B,114C 'caus':112C,156C 'chunk':83B,160C 'compon':47B,105C 'compos':34B 'condit':59B,126C 'content':150C,171C 'cve':15A,23A 'cwe':35B 'data':3A,99C 'delet':6A,80B 'disclosur':4A 'element':97C 'file':13A,54B,76B,82B,91B,118C,149C,159C,170C,182C 'fix':189C 'fmj8':21A 'ghsa':19A 'ghsa-8fxw-fmj8-xp7j':18A 'gridf':2A,37B,46B,104C,158C,196C 'id':14A,64B,197C 'identifi':55B,72B,119C,132C,140C 'impact':92C 'improp':93C 'influenc':70B,138C 'inject':11A 'instead':60B 'intend':153C,186C 'interpret':122C 'jira.mongodb.org':200C 'jira.mongodb.org/browse/phplib-1929':199C 'librari':44B,110C 'library':30A,33A 'liter':63B,131C 'logic':101C 'may':146C,177C 'mongodb':1A,28A,31A,38B,42B,108C 'mongodb/mongodb':26A,27A 'neutral':94C 'obtain':147C 'oper':10A,176C 'packag':39B 'pass':141C 'patch':188C 'php':29A,32A,40B,43B,109C 'queri':9A,58B,100C,125C 'query-oper':8A 'rather':127C 'read':74B 'refer':198C 'remov':167C 'renam':88B,175C,179C 'render':168C 'special':96C 'store':75B,148C,169C,181C 'structur':53B,117C 'suppli':52B,116C 'target':79B,154C,187C 'treat':48B 'unread':172C 'user':67B,135C 'valid':195C 'via':7A 'workaround':194C 'wrong':90B 'xp7j':22A","nicknames":[],"mitigations":[],"who_affected":"Applications that pass file identifiers from an authenticated user into the MongoDB PHP Library's GridFS functions are exposed. Applications that only use GridFS with server-generated IDs, or that do not use GridFS, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["mongodbmongodb","mongodbphplibrary","phplibrary"],"ptokens":["library","mongodb","php"],"labels":["composer","cwe943","gridfs","high","mongodb","package","php","vendor"],"campaign_type":null,"search_a":"'-2026':16A,24A '-88023':17A,25A '8fxw':20A 'cve':15A,23A 'data':3A 'delet':6A 'disclosur':4A 'file':13A 'fmj8':21A 'ghsa':19A 'ghsa-8fxw-fmj8-xp7j':18A 'gridf':2A 'id':14A 'inject':11A 'library':30A,33A 'mongodb':1A,28A,31A 'mongodb/mongodb':26A,27A 'oper':10A 'php':29A,32A 'queri':9A 'query-oper':8A 'via':7A 'xp7j':22A","search_b":"'-943':36B 'authent':66B 'beyond':77B 'bucket':86B 'caller':51B 'caller-suppli':50B 'chunk':83B 'compon':47B 'compos':34B 'condit':59B 'cwe':35B 'delet':80B 'file':54B,76B,82B,91B 'gridf':37B,46B 'id':64B 'identifi':55B,72B 'influenc':70B 'instead':60B 'librari':44B 'liter':63B 'mongodb':38B,42B 'packag':39B 'php':40B,43B 'queri':58B 'read':74B 'renam':88B 'store':75B 'structur':53B 'suppli':52B 'target':79B 'treat':48B 'user':67B 'wrong':90B","search_c":"'/browse/phplib-1929':201C '1.21.5':191C '2.4.2':193C 'affect':144C,163C,174C 'also':178C 'applic':145C 'authent':134C 'beyond':151C 'bucket':164C 'caller':115C 'caller-suppli':114C 'caus':112C,156C 'chunk':160C 'compon':105C 'condit':126C 'content':150C,171C 'data':99C 'element':97C 'file':118C,149C,159C,170C,182C 'fix':189C 'gridf':104C,158C,196C 'id':197C 'identifi':119C,132C,140C 'impact':92C 'improp':93C 'influenc':138C 'intend':153C,186C 'interpret':122C 'jira.mongodb.org':200C 'jira.mongodb.org/browse/phplib-1929':199C 'librari':110C 'liter':131C 'logic':101C 'may':146C,177C 'mongodb':108C 'neutral':94C 'obtain':147C 'oper':176C 'pass':141C 'patch':188C 'php':109C 'queri':100C,125C 'rather':127C 'refer':198C 'remov':167C 'renam':175C,179C 'render':168C 'special':96C 'store':148C,169C,181C 'structur':117C 'suppli':116C 'target':154C,187C 'unread':172C 'user':135C 'valid':195C 'workaround':194C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-10T18:18:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-8fxw-fmj8-xp7j","url":"https://github.com/advisories/GHSA-8fxw-fmj8-xp7j","severity":"medium","published_at":"2026-10-05T23:26:58+00:00","modified_at":"2026-11-09T16:49:16+00:00","first_seen_at":"2026-11-09T16:51:33+00:00","fetched_at":"2026-11-09T17:53:00+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-88023","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88023","severity":null,"published_at":"2026-09-10T18:18:12+00:00","modified_at":"2026-09-29T16:37:50+00:00","first_seen_at":"2026-11-09T16:57:34+00:00","fetched_at":"2026-11-09T16:57:34+00:00","note":null}],"documents":[{"id":108365,"url":"https://api.github.com/repos/mongodb/mongo-php-library/security-advisories/GHSA-8fxw-fmj8-xp7j","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":108366,"url":"https://github.com/mongodb/mongo-php-library/security/advisories/GHSA-8fxw-fmj8-xp7j","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":108367,"url":"https://github.com/mongodb/mongo-php-library/pull/1981","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":108368,"url":"https://github.com/mongodb/mongo-php-library/commit/8c0b165069ab29d52a80a379a947ac9a55734601","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":108369,"url":"https://github.com/mongodb/mongo-php-library/releases/tag/1.21.5","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":108370,"url":"https://github.com/mongodb/mongo-php-library/releases/tag/2.4.2","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":108383,"url":"https://jira.mongodb.org/browse/PHPLIB-1929","title":"Vendor advisory: jira.mongodb.org","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: jira.mongodb.org"}],"disclosures":[],"exploit_sources":[{"type":"epss","score":0.00326,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88023"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}