MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs (CVE-2026-88023)

Package: mongodb/mongodb
Fixed in: 1.24.5, 2.4.2
Published: Tue 6 Oct 2026, 00:26 LisbonUpdated Mon 26 Oct 2026, 03:26 Lisbon
Installs on Packagist: 74M

In plain words

The MongoDB PHP Library's GridFS component can treat a caller-supplied structured file ID as a query condition rather than a literal ID. If an authenticated user can influence that ID, they may read file content beyond the intended target, delete all file chunks in the affected bucket and make its stored content unreadable, or rename a different file from the intended one.

Affected versions

Package	Affected	Fixed in
mongodb/mongodb	>= 1.1.0, < 1.21.5	1.24.5
mongodb/mongodb	>= 2.0.0, < 2.4.2	2.4.2

Am I affected?

Check the mongodb/mongodb version in composer.lock: affected ranges are >= 1.1.0, < 1.21.5 and >= 2.0.0, < 2.4.2. If your version is affected, check whether your application uses GridFS and lets authenticated users influence the file IDs passed to its operations, including structured IDs.

What to do

Check which version you have, then update to a fixed release for your branch (1.24.5, 2.4.2):

composer show mongodb/mongodb | grep versions
composer update mongodb/mongodb

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

Validate GridFS IDs.

The advisory's description

Impact

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.

Patches

Fixed in 1.21.5 and 2.4.2.

Workarounds

Validate GridFS IDs.

References

https://jira.mongodb.org/browse/PHPLIB-1929

The advisory

GitHub Advisory Database: GHSA-8fxw-fmj8-xp7j, with who is affected and how
OSV.dev: GHSA-8fxw-fmj8-xp7j
The week's digest, with the other advisories from 5 Oct 2026
All advisories for mongodb/mongodb

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description, affected versions, weakness and credits are from the GitHub Advisory Database (CC BY 4.0). "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.