SB20261110289 - Improper Neutralization of Special Elements in Data Query Logic in mongo-php-library

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261110289

SB20261110289 - Improper Neutralization of Special Elements in Data Query Logic in mongo-php-library

Published: November 10, 2026

Security Bulletin ID SB20261110289
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper Neutralization of Special Elements in Data Query Logic (CVE-ID: CVE-2026-88023)

CWE-ID: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose stored file content, render stored files unreadable, or rename unintended files.

The vulnerability exists due to improper neutralization of special elements in query logic in the MongoDB PHP Library GridFS component when processing structured file identifiers as query conditions rather than literal identifiers. A remote user can influence file identifiers passed by an affected application to retrieve content beyond the intended target, delete all file chunks in the affected bucket, or rename an unintended file.


Remediation

Install update from vendor's website.

References