Executive brief
The MongoDB PHP Library's GridFS component, used for storing and retrieving large files, fails to properly sanitize file identifiers when building database queries. An authenticated attacker who can control how a file is referenced could read unintended files, delete all files in a storage bucket, or rename the wrong file. This puts sensitive file content at risk of unauthorized access or loss.
Technical details
The vulnerability is an improper neutralization of special elements in data query logic (CWE-89 equivalent – query injection) within the GridFS component of the MongoDB PHP Library. The root cause is that caller-supplied file identifiers are interpolated directly into database query conditions instead of being matched as literal values using the $eq operator. An authenticated user with the ability to influence the file identifier parameter can craft a structured object that is interpreted as a query condition, allowing them to retrieve stored file content beyond the intended target, delete all chunks in the affected bucket, or rename unintended files. Attack requires application-level authentication and the ability to control the file ID parameter. Patches are available in version 2.4.2 and 1.21.5.
Affected products
- MongoDB PHP Library before 2.4.2 and 1.21.5
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: Versions 2.4.2 and 1.21.5 released with fix