Executive brief
The MongoDB Ruby Driver contains a vulnerability in its GridFS file storage component that allows authenticated users to manipulate how file identifiers are interpreted. An attacker can craft malicious file identifiers that are treated as database query conditions instead of literal identifiers, potentially exposing other files' contents or deleting all file chunks in a storage bucket, causing stored files to become inaccessible.
Technical details
The GridFS component of the MongoDB Ruby Driver improperly neutralizes special elements in data query logic, failing to enforce that user-supplied file identifiers are matched literally rather than interpreted as query operators. The vulnerability exists in GridFS delete and retrieval methods which do not use the $eq operator to enforce exact matching of file IDs in database commands. An authenticated user who can influence the file identifier parameter passed by an application can inject query conditions (e.g., {"$ne": null}) to access unintended files or delete all file chunks in a bucket. The fix, available in version 2.26.0, wraps all user-supplied GridFS file IDs with explicit $eq matching operators in database commands.
Affected products
- MongoDB Ruby Driver 2.25.0
Timeline
- 2026-09-10: disclosed: CVE-2026-88030 published
- 2026-09-11: patched: Fix released in version 2.26.0