# CVE-2026-88033: MongoDB Java Driver GridFS query injection in file identifiers

Source: https://junglewise.ai/threats/cve-2026-88033-mongodb-java-driver-gridfs-query-injection-in-file-identifiers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-88033 · Severity: high · CVSS 8.3 · Published 2026-09-10

The MongoDB Java Driver's GridFS component (used to store and retrieve large files in MongoDB) improperly handles file identifiers, allowing authenticated users to manipulate queries in unintended ways. An attacker could read files beyond their access scope, delete all files in a storage bucket, or rename files other than the intended target, disrupting file storage operations and causing data loss or unauthorized access.

Technologies: [MongoDB Java Driver](https://junglewise.ai/threats/technologies/java-driver). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-88033 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88033 being exploited in the wild.

**How severe is CVE-2026-88033?** High severity, with a CVSS score of 8.3, published 10 September 2026.

**Which products and versions are affected?** MongoDB Java Driver before 5.11.1.

**Is there a fix for CVE-2026-88033?** A patch was published on 2026-09-10: Fix released in version 5.11.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-88033 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-88033?** Check whether you run MongoDB Java Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a query injection flaw in the GridFS component of the MongoDB Java Driver, where user-supplied file identifiers are not properly neutralized before being used in database query logic. Instead of matching file identifiers as literal values, the driver interprets them as query conditions (e.g., operators like $eq, $ne), allowing an authenticated attacker to construct malicious identifiers to bypass intended file access controls. The attack requires an application to pass attacker-controlled data as a file identifier to GridFS operations (delete, read, rename). An attacker can leverage this to read unauthorized files, delete entire buckets of GridFS chunks, or rename arbitrary files. The fix, available in version 5.11.1, implements explicit $eq matching for all user-supplied GridFS file IDs in database commands.

## Affected products

- MongoDB Java Driver before 5.11.1

## Timeline

- 2026-09-10: disclosed
- 2026-09-10: patched: Fix released in version 5.11.1

## References

- [https://jira.mongodb.org/browse/JAVA-6283](https://jira.mongodb.org/browse/JAVA-6283)

## Related threats

- [MongoDB Java Driver BSON document length validation bypass](https://junglewise.ai/threats/cve-2026-118581-a-bson-encoding-component-of-the-mongodb-java-driver-does-not)
- [MongoDB Java Driver use-after-free in reactive encryption](https://junglewise.ai/threats/cve-2026-88032-mongodb-java-driver-use-after-free-in-reactive-encryption)
- [A MongoDB driver component could write sensitive configuration information, including a credential used for outbound…](https://junglewise.ai/threats/cve-2026-18710-a-mongodb-driver-component-could-write-sensitive-configuration)