GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java Driver

High8.3CVE-2026-88033 · Published Sep 10, 2026

### Impact An improper neutralization of a query operator in the GridFS delete methods allows unintended data deletion. `GridFSBucket.delete(BsonValue id)` accepts an arbitrary BSON value for the id of the file to delete and uses it directly as the filter value: ``` { _id: <id> } // on <bucket>.files { files_id: <id> } // on <bucket>.chunks ``` Because MongoDB interprets a document whose keys begin with $ in that position as a query predicate rather than a literal value, an id such as `{"$gt": {"$minKey": 1}} or {"$ne": null}` matches most or all files in the bucket instead of one. **Who is impacted**: applications that call `GridFSBucket.delete(BsonValue)` (or the reactive/Scala equivalents) with a BsonValue derived from untrusted input ### Patches Upgrade reactive/sync driver version to 5.11.1 or later ### Workarounds Applications using older driver versions should call another delete overload `delete(ObjectId)` . The driver constructs the `BsonObjectId` internally from a typed value, so no document can reach the filter. ### References https://jira.mongodb.org/browse/JAVA-6283 https://www.cve.org/CVERecord?id=CVE-2026-88033