CVE-2026-88036High· 8.3▾ TwilightImproper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identi…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 11.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.5%
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.
c_driver >= 1.14.0, < 1.30.10c_driver >= 2.0.0, < 2.5.2Upgrade past the affected range:
c_driver 2.5.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114648High· 7.6NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys
CVE-2026-114647Medium· 4.3NoSQL operator injection via unvalidated replacement document in findOneAndReplace
CVE-2026-114652Medium· 6.5Update operator injection via single-element list rewriting in the update builder
CVE-2026-96744High· 7.1Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than…
CVE-2026-93760High· 8.2Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods
CVE-2026-93394Low· 3.7A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message