Improper Neutralization of Special Elements in Data Query Logic in MongoDB driver for C - CVE-2026-88036

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU151669

Improper Neutralization of Special Elements in Data Query Logic in MongoDB driver for C - CVE-2026-88036

Published: September 22, 2026


Vulnerability identifier: #VU151669
CSH Severity: Medium
CVSS v4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-88036
CWE-ID: CWE-943
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to disclose stored file content or delete GridFS file chunks.

The vulnerability exists due to improper neutralization of special elements in data query logic in the GridFS component when processing caller-supplied structured file identifiers. A remote user can supply a structured file identifier that is interpreted as a query condition to disclose stored file content or delete GridFS file chunks.


Affected software

MongoDB driver for C
Fedora
mongo-c-driver

How to mitigate CVE-2026-88036

Install security update from vendor's website.

MongoDB driver for C - addressed in versions 1.30.10, 2.5.3
mongo-c-driver - addressed in versions 1.30.10-1.el9, 1.30.10-1.el10_2, 1.30.10-1.fc43, 1.30.10-1.fc44, 1.30.11-1.el8, 1.30.11-1.el9, 1.30.11-1.fc43, 1.30.11-1.fc44, 2.5.3-1.el10_3, 2.5.3-1.fc45, 2.5.4-1.el10_3, 2.5.4-1.el10_4, 2.5.4-1.fc45

External References

Related Security Bulletins