GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java Driver

Impact

An improper neutralization of a query operator in the GridFS delete methods allows unintended data deletion.

GridFSBucket.delete(BsonValue id) accepts an arbitrary BSON value for the id of the file to delete and uses it directly as the filter value:

`

{ _id: <id> } // on <bucket>.files

{ files_id: <id> } // on <bucket>.chunks

`

Because MongoDB interprets a document whose keys begin with $ in that position as a query predicate rather than a literal value, an id such as {"$gt": {"$minKey": 1}} or {"$ne": null} matches most or all files in the bucket instead of one.

Who is impacted: applications that call GridFSBucket.delete(BsonValue) (or the reactive/Scala equivalents) with a BsonValue derived from untrusted input

Patches

Upgrade reactive/sync driver version to 5.11.1 or later

Workarounds

Applications using older driver versions should call another delete overload delete(ObjectId) .

The driver constructs the BsonObjectId internally from a typed value, so no document can reach the filter.

References

https://jira.mongodb.org/browse/JAVA-6283

https://www.cve.org/CVERecord?id=CVE-2026-88033