CVE-2026-88030

A flaw was found in the GridFS component of the MongoDB Ruby Driver. Improper neutralization of special elements in data query logic can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target, leading to data disclosure. Additionally, this flaw could allow an attacker to cause all GridFS file chunks in the affected bucket to be removed, resulting in a Denial of Service (DoS).

Red Hat rates this vulnerability as Important because successful exploitation can allow an authenticated attacker to delete entire bucket contents or access unauthorized files, resulting in substantial integrity and availability loss. In typical deployments, the MongoDB Ruby gem is utilized within custom Ruby applications interacting with MongoDB datastores. The risk is elevated in environments where applications accept structured input from untrusted callers and forward it directly to GridFS file operations without validating that the identifier is a primitive type.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.