CVE-2026-88030CWE-943

CVE-2026-88030

High · published September 10, 2026

CVSS v3.1
8.3
EPSS
0%
Percentile
17.4
In the wild
Unconfirmed
What it is

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
CVSS v4.0
6.1 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00265 · 17.4th percentile
Weakness
CWE-943 · Improper Neutralization of Special Elements in Data Query Logic
Published
2026-09-10T22:18Z
Affected products (1)
ProductVersionsFixed in
mongodb/ruby_driver≥ 2.0.0, < 2.26.02.26.0
References (1)
https://jira.mongodb.org/browse/RUBY-3941 · [email protected]
EPSS history
Timeline
  • 12 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 10 SEP 17:57Z
    GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Ruby Driver
    cvelistv5