Upstream information
CVE-2026-88030 at MITRE
Description
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.
Overall state of this security issue: Resolved
This issue is currently rated as having important severity.
CVSS v3 Scores
| CVSS detail | CNA (MongoDB) |
|---|
| Base Score | 8.3 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | Low |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality Impact | Low |
| Integrity Impact | High |
| Availability Impact | High |
| CVSSv3 Version | 3.1 |
CVSS v4 Scores
| CVSS detail | CNA (MongoDB) |
|---|
| Base Score | 6.1 |
| Vector | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| Attack Vector | Network |
| Attack Complexity | Low |
| Attack Requirements | Present |
| Privileges Required | Low |
| User Interaction | None |
| Vulnerable System Confidentiality Impact | Low |
| Vulnerable System Integrity Impact | High |
| Vulnerable System Availability Impact | High |
| Subsequent System Confidentiality Impact | None |
| Subsequent System Integrity Impact | None |
| Subsequent System Availability Impact | None |
| CVSSv4 Version | 4.0 |
No SUSE Bugzilla entries cross referenced.
No SUSE Security Announcements cross referenced.
List of released packages
| Product(s) | Fixed package version(s) | References |
|---|
| SUSE Liberty Linux 8 | ruby >= 2.5.9-116.module+el8.10.0+24853+52b5af56ruby-devel >= 2.5.9-116.module+el8.10.0+24853+52b5af56ruby-doc >= 2.5.9-116.module+el8.10.0+24853+52b5af56ruby-irb >= 2.5.9-116.module+el8.10.0+24853+52b5af56ruby-libs >= 2.5.9-116.module+el8.10.0+24853+52b5af56rubygem-abrt >= 0.3.0-4.module+el8.10.0+22021+135c76a8rubygem-abrt-doc >= 0.3.0-4.module+el8.10.0+22021+135c76a8rubygem-bigdecimal >= 1.3.4-116.module+el8.10.0+24853+52b5af56rubygem-bson >= 4.3.0-2.module+el8.9.0+19193+435404aerubygem-bson-doc >= 4.3.0-2.module+el8.9.0+19193+435404aerubygem-bundler >= 1.16.1-5.module+el8.10.0+23088+750dc6carubygem-bundler-doc >= 1.16.1-5.module+el8.10.0+23088+750dc6carubygem-did_you_mean >= 1.2.0-116.module+el8.10.0+24853+52b5af56rubygem-io-console >= 0.4.6-116.module+el8.10.0+24853+52b5af56rubygem-json >= 2.1.0-116.module+el8.10.0+24853+52b5af56rubygem-minitest >= 5.10.3-116.module+el8.10.0+24853+52b5af56rubygem-mongo >= 2.5.1-3.module+el8.10.0+24944+b1921893rubygem-mongo-doc >= 2.5.1-3.module+el8.10.0+24944+b1921893rubygem-mysql2 >= 0.4.10-4.module+el8.9.0+19193+435404aerubygem-mysql2-doc >= 0.4.10-4.module+el8.9.0+19193+435404aerubygem-net-telnet >= 0.1.1-116.module+el8.10.0+24853+52b5af56rubygem-openssl >= 2.1.2-116.module+el8.10.0+24853+52b5af56rubygem-pg >= 1.0.0-3.module+el8.9.0+19193+435404aerubygem-pg-doc >= 1.0.0-3.module+el8.9.0+19193+435404aerubygem-power_assert >= 1.1.1-116.module+el8.10.0+24853+52b5af56rubygem-psych >= 3.0.2-116.module+el8.10.0+24853+52b5af56rubygem-rake >= 12.3.3-116.module+el8.10.0+24853+52b5af56rubygem-rdoc >= 6.0.1.1-116.module+el8.10.0+24853+52b5af56rubygem-test-unit >= 3.2.7-116.module+el8.10.0+24853+52b5af56rubygem-xmlrpc >= 0.3.0-116.module+el8.10.0+24853+52b5af56rubygems >= 2.7.6.3-116.module+el8.10.0+24853+52b5af56rubygems-devel >= 2.7.6.3-116.module+el8.10.0+24853+52b5af56
| Patchnames:
RHSA-2026:73519 (i686,x86_64) |
SUSE Timeline for this CVE
CVE page created: Thu Oct 1 16:53:05 2026
CVE page last modified: Thu Oct 1 16:53:05 2026
