High severity8.3NVD Advisory· Published Sep 10, 2026· Updated Sep 29, 2026
CVE-2026-88023
CVE-2026-88023
Description
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
mongodb/mongodbPackagist | >= 1.1.0, < 1.24.5 | 1.24.5 |
mongodb/mongodbPackagist | >= 2.0.0, < 2.4.2 | 2.4.2 |
Affected products
2Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-8fxw-fmj8-xp7jghsaADVISORY
- jira.mongodb.org/browse/PHPLIB-1929nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-88023ghsaADVISORY
- github.com/mongodb/mongo-php-library/commit/8c0b165069ab29d52a80a379a947ac9a55734601ghsaWEB
- github.com/mongodb/mongo-php-library/pull/1981ghsaWEB
- github.com/mongodb/mongo-php-library/releases/tag/1.21.5ghsaWEB
- github.com/mongodb/mongo-php-library/releases/tag/2.4.2ghsaWEB
- github.com/mongodb/mongo-php-library/security/advisories/GHSA-8fxw-fmj8-xp7jghsaWEB
News mentions
1- MongoDB: 14 Vulnerabilities Disclosed, GridFS & Server Impacted in 24h WindowVypr Intelligence · Sep 11, 2026