---
id: "CVE-2026-88023"
page: "https://infrastack.ai/live/CVE-2026-88023"
kind: "vulnerability"
aliases: ["CVE-2026-88023", "GHSA-8fxw-fmj8-xp7j"]
title: "MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs"
severity: "high"
cvss: 8.3
epss: 0.00326
exploited: false
status: "open"
category: "package"
products: [{"name": "mongodb/mongodb", "fixed": ["1.21.5"], "affected": ">= 1.1.0, < 1.21.5", "ecosystem": "composer"}, {"name": "mongodb/mongodb", "fixed": ["2.4.2"], "affected": ">= 2.0.0, < 2.4.2", "ecosystem": "composer"}, {"name": "mongodb php library", "fixed": ["1.21.5"], "affected": ">= 1.1.0, < 1.21.5", "ecosystem": "vendor"}, {"name": "mongodb php library", "fixed": ["2.4.2"], "affected": ">= 2.0.0, < 2.4.2", "ecosystem": "vendor"}]
ecosystems: ["composer", "vendor"]
tags: ["composer", "cwe-943", "gridfs", "mongodb", "package", "php"]
not_affected_if: ["no-gridfs", "patched-version", "server-generated-ids"]
published_at: "2026-09-10T18:18:12+00:00"
first_seen_at: "2026-11-09T16:51:33+00:00"
updated_at: "2026-11-09T16:57:34+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-8fxw-fmj8-xp7j", "first_seen_at": "2026-11-09T16:51:33+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88023", "first_seen_at": "2026-11-09T16:57:34+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.00326, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-88023"}]
---

# MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

Link for people: https://infrastack.ai/live/CVE-2026-88023 (this .md is for agents)

The MongoDB PHP Library's GridFS component treats a caller-supplied structured file identifier as a query condition instead of a literal ID. An authenticated user who can influence that identifier can read stored files beyond their target, delete all file chunks in the bucket, or rename the wrong file.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:mongodb/mongodb affected >= 1.1.0, < 1.21.5 fixed 1.21.5
- composer:mongodb/mongodb affected >= 2.0.0, < 2.4.2 fixed 2.4.2
- vendor:mongodb php library affected >= 1.1.0, < 1.21.5 fixed 1.21.5
- vendor:mongodb php library affected >= 2.0.0, < 2.4.2 fixed 2.4.2

## How to check

- Check the locked version of `mongodb/mongodb` in `composer.lock`; affected if below `1.21.5` on the 1.x line or below `2.4.2` on the 2.x line.
- Search application code for GridFS calls (`downloadToStream`, `delete`, `rename`) that take an ID from user input.

## Fix

- `mongodb/mongodb` 1.x: upgrade to `1.21.5`
- `mongodb/mongodb` 2.x: upgrade to `2.4.2`
- Workaround stated by the advisory: validate GridFS IDs before use.

## Timeline

- 2026-11-09T16:51:33+00:00 ghsa https://github.com/advisories/GHSA-8fxw-fmj8-xp7j
- 2026-11-09T16:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88023

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/mongodb/mongo-php-library/security/advisories/GHSA-8fxw-fmj8-xp7j
- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/mongodb/mongo-php-library/security-advisories/GHSA-8fxw-fmj8-xp7j
- [advisory] Vendor advisory: jira.mongodb.org https://jira.mongodb.org/browse/PHPLIB-1929
- [fix] Release: github.com https://github.com/mongodb/mongo-php-library/releases/tag/2.4.2
- [fix] Patch: github.com https://github.com/mongodb/mongo-php-library/commit/8c0b165069ab29d52a80a379a947ac9a55734601
- [fix] Patch: github.com https://github.com/mongodb/mongo-php-library/pull/1981
- [fix] Release: github.com https://github.com/mongodb/mongo-php-library/releases/tag/1.21.5

## From the sources

### Impact
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.


### Patches
Fixed in 1.21.5 and 2.4.2.

### Workarounds
Validate GridFS IDs.

### References
https://jira.mongodb.org/browse/PHPLIB-1929

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_