GridFS data deletion via operator-document injection in file IDs

Medium6.1CVE-2026-88031 · Published Sep 10, 2026

### Impact In GridFS delete methods, the file ID lookup could match more loosely than intended, potentially causing unintended file (and chunk) deletions instead of an exact match on the given file ID. ### Patches Upgrade to Go Driver v2.9.1 / v1.17.10 or later. ### Workarounds Users can manually restrict the file ID with a `$eq` operator before passing it to GridFSBucket methods using code like the following. ``` go func exactMatch(id any) bson.D { return bson.D{{"$eq", id}} } // e.g., for v1, (*Bucket).DeleteContext() with an exact match on the file ID. bucket.DeleteContext(context.TODO(), exactMatch(id)) // e.g., for v2, (*GridFSBucket).Delete() with an exact match on the file ID. gridFSBucket.Delete(context.TODO(), exactMatch(id)) ``` ### References [GODRIVER-4081](https://jira.mongodb.org/browse/GODRIVER-4081)