CVE-2026-88031

A flaw was found in go.mongodb.org/mongo-driver for version < 1.17.10 and < 2.9.1. Improper handling of data query elements in the GridFS component can lead to a file identifier being misinterpreted as a query. An authenticated user can exploit this to delete all GridFS file chunks, making stored file content unreadable, resulting in a denial of service.

A flaw was found in the MongoDB Go Driver. The GridFS component does not properly sanitize caller-supplied file identifiers before using them in database queries. A structured document passed as a file ID (for example, a BSON document containing query operators) is interpreted as a query condition rather than a literal match value. An authenticated attacker who can influence the file identifier passed to GridFS operations such as Delete, DownloadToStream, or OpenDownloadStream in an affected application can exploit this to delete all chunks in a GridFS bucket, resulting in permanent data loss and denial of service. The practical impact depends on whether the product's code passes externally-controlled values as GridFS file identifiers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If upgrading go.mongodb.org/mongo-driver to version 1.17.10 (v1) or 2.9.1 (v2) is not immediately possible, the following steps can reduce exposure:

• Validate file identifiers before passing them to GridFS operations. Ensure that file IDs supplied by users or external systems are scalar values (e.g., primitive.ObjectID or string) and reject any structured BSON documents or maps. This prevents query operator injection.
• Restrict who can supply GridFS file identifiers. Do not allow unauthenticated or low-privilege users to directly control the file ID parameter in GridFS API calls (Delete, OpenDownloadStream, DownloadToStream, etc.).