Improper Neutralization of Special Elements in Data Query Logic in mongo-php-library - CVE-2026-88023
Published: November 10, 2026
Vulnerability identifier: #VU164406
CSH Severity: Medium
CVSS v4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-88023
CWE-ID: CWE-943
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose stored file content, render stored files unreadable, or rename unintended files.
The vulnerability exists due to improper neutralization of special elements in query logic in the MongoDB PHP Library GridFS component when processing structured file identifiers as query conditions rather than literal identifiers. A remote user can influence file identifiers passed by an affected application to retrieve content beyond the intended target, delete all file chunks in the affected bucket, or rename an unintended file.
Affected software
mongo-php-library
How to mitigate CVE-2026-88023
Install security update from vendor's website.
mongo-php-library - addressed in versions 1.21.5, 2.4.2