Executive brief
MongoDB's Go Driver includes a GridFS component for storing and retrieving large files. A flaw in the file deletion logic allows file identifiers supplied by applications to be misinterpreted as database query filters instead of literal values. An authenticated user who can control the file identifier could cause all file chunks in a GridFS bucket to be deleted, making stored files unreadable and unavailable to legitimate users.
Technical details
The vulnerability is an improper neutralization (CWE-93) in the GridFS component's delete methods, where user-supplied file identifiers are not properly escaped as literal values before being used in database query conditions. An authenticated attacker who can influence the file ID parameter passed to GridFS delete operations can craft a malicious identifier that is interpreted as a MongoDB query operator (e.g., a conditional expression) rather than a literal file identifier. This allows deletion of unintended file chunks, potentially removing all chunks in the affected bucket. The fix, released in Go Driver versions 1.17.10 and 2.9.1, explicitly uses the $eq operator to enforce literal matching of file identifiers. No public exploits are known at the time of publication.
Affected products
- MongoDB Go Driver before 1.17.10 and 2.9.1
Timeline
- 2026-08-11: other: Issue created
- 2026-09-09: patched: Fix resolved
- 2026-09-10: disclosed: CVE-2026-88031 published