CVE-2026-88031
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
The GridFS component of the MongoDB Go Driver contains an improper neutralization of special elements in data query logic, where a caller-supplied structured file identifier can be interpreted as a query condition rather than a literal identifier. An authenticated user who can influence the identifier may cause all GridFS file chunks in the affected bucket to be removed.
Risk Assessment
This can lead to data loss by removing file chunks, making stored content unreadable.
Recommendation
Upgrade MongoDB Go Driver to a version containing the fix. Validate file identifiers passed to GridFS.
Other vulnerabilities in MongoDB Go Driver
See all- CVE-2026-107325Medium
Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service.
- CVE-2026-107324Medium
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service.
- CVE-2026-81521Medium
The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace. An application passing untrusted input as a database name could have the write directed at a database and collection other than intended.
Original NVD description (English source)
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS