Executive brief
The MongoDB Java Driver's GridFS component (used to store and retrieve large files in MongoDB) improperly handles file identifiers, allowing authenticated users to manipulate queries in unintended ways. An attacker could read files beyond their access scope, delete all files in a storage bucket, or rename files other than the intended target, disrupting file storage operations and causing data loss or unauthorized access.
Technical details
The vulnerability is a query injection flaw in the GridFS component of the MongoDB Java Driver, where user-supplied file identifiers are not properly neutralized before being used in database query logic. Instead of matching file identifiers as literal values, the driver interprets them as query conditions (e.g., operators like $eq, $ne), allowing an authenticated attacker to construct malicious identifiers to bypass intended file access controls. The attack requires an application to pass attacker-controlled data as a file identifier to GridFS operations (delete, read, rename). An attacker can leverage this to read unauthorized files, delete entire buckets of GridFS chunks, or rename arbitrary files. The fix, available in version 5.11.1, implements explicit $eq matching for all user-supplied GridFS file IDs in database commands.
Affected products
- MongoDB Java Driver before 5.11.1
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: Fix released in version 5.11.1