Improper Neutralization Of Special Elements In Data Query Logic

MongoDB Python Driver is vulnerable to Improper Neutralization of Special Elements in Data Query Logic. The vulnerability is due to improper handling of caller-supplied structured file identifiers, which allows an authenticated attacker to manipulate GridFS queries to access unintended stored fil...

CVE-2026-48204

CVE-2026-48204 — camel-mongodb-gridfs gridfs. 헤더 주입 동일한 Apache Camel 취약점에 대한 실행 가능한 개념 증명 재현기reproducer로, 런타임별로 하나씩 제공됩니다: 런타임| 디렉터리| 스택 ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus| camel-quarkus/| Quarkus 3.36.0 + Camel Quarkus...

EUVD-2026-75665

pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods...

GHSA-8FVV-FGR5-F8CH pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods

Impact When reading/writing via an ID with the GridFS API, require an exact match on the given ID. Otherwise, if a Hash is given in place of the ID, it may be interpreted as criteria, overriding the ID match. Patches Patch available in pymongo = 4.18.1 Workarounds Ensure your existing workflow on...

pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods

Impact When reading/writing via an ID with the GridFS API, require an exact match on the given ID. Otherwise, if a Hash is given in place of the ID, it may be interpreted as criteria, overriding the ID match. Patches Patch available in pymongo = 4.18.1 Workarounds Ensure your existing workflow on...

MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

Impact Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

GHSA-8FXW-FMJ8-XP7J MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

Impact Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

EUVD-2026-75637

MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs...

rubygem-mongo: MongoDB Ruby Driver: Data disclosure and denial of service via query-operator injection

A flaw was found in the GridFS component of the MongoDB Ruby Driver. Improper neutralization of special elements in data query logic can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal identifier. An authenticated user who can...

Important: python-pymongo

Issue Overview: Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can...

Amazon Linux 2023 : python3-bson, python3-pymongo, python3-pymongo-gridfs (ALAS2023-2026-3121)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3121 advisory. Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query...

Fedora 45 : mongo-c-driver (2026-0fcc2d09c6)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0fcc2d09c6 advisory. libmongoc 2.5.4 Fixes - Fix allocation in Windows Secure Channel. ---- libmongoc 2.5.3 Fixes - Use exact match for file ID in GridFS methods...

CVE-2026-88033

A flaw was found in the GridFS component of the MongoDB Java Driver. Improper neutralization of special elements in data query logic can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal identifier. An authenticated user can exploit th...

CVE-2026-88030

A flaw was found in the GridFS component of the MongoDB Ruby Driver. Improper neutralization of special elements in data query logic can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal identifier. An authenticated user who can...

SUSE CVE-2026-88036

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier...

CVE-2026-88031

A flaw was found in go.mongodb.org/mongo-driver for version 1.17.10 and 2.9.1. Improper handling of data query elements in the GridFS component can lead to a file identifier being misinterpreted as a query. An authenticated user can exploit this to delete all GridFS file chunks, making stored fil...

SUSE CVE-2026-88029

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

Linux Distros Unpatched Vulnerability : CVE-2026-88030

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file...

Linux Distros Unpatched Vulnerability : CVE-2026-88031

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file...

Linux Distros Unpatched Vulnerability : CVE-2026-88034

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplied structured file...