GHSA-8fxw-fmj8-xp7j: Composer/mongodb/mongodb vulnerability

Q: Who can exploit this issue in a deployed application?

An authenticated user must be able to influence the file identifier that the application passes to GridFS operations. The issue is in application use of the MongoDB PHP Library's GridFS component, not merely in the presence of stored GridFS files.

Q: Which operations can be affected?

A structured identifier may be interpreted as a query condition during GridFS access, allowing retrieval of unintended stored file content. It can also cause deletion of all chunks in an affected bucket, making stored content unreadable, or rename a file other than the intended one.

Q: What versions contain fixes?

The issue is fixed in MongoDB PHP Library versions 1.21.5 and 2.4.2.

Q: What can be done if updating is not immediately possible?

Validate GridFS IDs before passing them to the library. This prevents caller-supplied structured values from being treated as query conditions rather than literal identifiers.

Published Oct 5, 2026

Updated

Impact Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.

Patches Fixed in 1.21.5 and 2.4.2.

Workarounds Validate GridFS IDs.

References https://jira.mongodb.org/browse/PHPLIB-1929

Affected Software

2 affected componentsFixes available

composer/mongodb/mongodb>=2.0.0<2.4.2

2.4.2

composer/mongodb/mongodb>=1.1.0<1.21.5

1.24.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/mongodb/mongodb to a version that resolves this vulnerability.
Fixed in 2.4.2
Upgrade
Upgrade composer/mongodb/mongodb to a version that resolves this vulnerability.
Fixed in 1.24.5
Upgrade
Upgrade MongoDB PHP Library to a version that resolves this vulnerability.
Fixed in 1.21.5
Upgrade
Upgrade MongoDB PHP Library to a version that resolves this vulnerability.
Fixed in 2.4.2
Configuration
Validate GridFS IDs before using caller-supplied structured file identifiers.
GridFS GridFS ID validation = enabled

Event History

Oct 5, 2026

Advisory Published

via GitHub·11:26 PM

Data Sourced

via GitHub·11:26 PM

DescriptionAffected Software

Frequently Asked Questions

Who can exploit this issue in a deployed application?

An authenticated user must be able to influence the file identifier that the application passes to GridFS operations. The issue is in application use of the MongoDB PHP Library's GridFS component, not merely in the presence of stored GridFS files.

Which operations can be affected?

A structured identifier may be interpreted as a query condition during GridFS access, allowing retrieval of unintended stored file content. It can also cause deletion of all chunks in an affected bucket, making stored content unreadable, or rename a file other than the intended one.

What versions contain fixes?

The issue is fixed in MongoDB PHP Library versions 1.21.5 and 2.4.2.

What can be done if updating is not immediately possible?

Validate GridFS IDs before passing them to the library. This prevents caller-supplied structured values from being treated as query conditions rather than literal identifiers.

GHSA-8fxw-fmj8-xp7j: Composer/mongodb/mongodb vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue in a deployed application?

Which operations can be affected?

What versions contain fixes?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue in a deployed application?

Which operations can be affected?

What versions contain fixes?

What can be done if updating is not immediately possible?