CVE-2026-88033

Name of the Vulnerable Software and Affected Versions MongoDB Java Driver (affected versions not specified)

Description Improper neutralization of special elements in the data query logic within the GridFS component allows a structured file identifier provided by a caller to be interpreted as a query condition instead of a literal identifier. An authenticated user capable of influencing the identifier used by an application may access stored file content beyond the intended target, rename files other than the intended target, or delete all GridFS file chunks in the affected bucket, making the stored content unreadable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.