CVE-2026-88023

HighCVSS 8.3

Published: 10/09/2026(UTC)Updated: 29/09/2026(UTC)Translated: 11/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

38th percentile - higher than 38% of all known CVEs

Summary

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target, cause all GridFS file chunks in the affected bucket to be removed, or rename a stored file other than the intended target.

Risk Assessment

An attacker with user privileges could read or destroy data stored in GridFS, rendering it unreadable and compromising confidentiality and integrity. This may lead to data loss and disruption of application operations.

Recommendation

Update the MongoDB PHP Library to a patched version and validate and normalize file identifiers passed to GridFS operations. Restrict the ability of users to influence identifiers used in queries.

Other vulnerabilities in MongoDB PHP Library

CVE-2026-81525High
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than intended.

Original NVD description (English source)

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS