CVE-2026-88029

Improper input handling in MongoDB Python GridFS rename lets attackers access or delete other files.

• CVSS 6.1
• 943
• Input Validation and Sanitization
• Remote

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.

CVE

CVE-2026-88029

CWE

943

CVSS base score

6.1

Published

2026-09-10

OWASP

A03 Injection

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Insecure Direct Object References (IDOR)

Accessibility scope

Remote

Impact

Information Disclosure

Affected component

PyMongo

Fixed by upgrading

Yes

Solution

Upgrade the MongoDB Python Driver (pymongo) to version 4.5.0 or later, which patches the GridFS identifier injection vulnerability.

import pymongo
from pymongo import MongoClient
from gridfs import GridFS

def rename_file(file_id, new_name):
    client = MongoClient()
    db = client.mydb
    fs = GridFS(db)

    # VULNERABLE: file_id is used directly as a query filter
    file_doc = db.fs.files.find_one(file_id)
    if not file_doc:
        raise ValueError("File not found")

    fs.rename(file_doc["_id"], new_name)

import pymongo
from pymongo import MongoClient
from gridfs import GridFS
from bson.objectid import ObjectId

def rename_file(file_id, new_name):
    client = MongoClient()
    db = client.mydb
    fs = GridFS(db)

    # FIX: ensure file_id is treated as a literal ObjectId
    try:
        oid = ObjectId(file_id) if not isinstance(file_id, ObjectId) else file_id
    except Exception:
        raise ValueError("Invalid file identifier")

    file_doc = db.fs.files.find_one({"_id": oid})
    if not file_doc:
        raise ValueError("File not found")

    fs.rename(file_doc["_id"], new_name)

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202688029,
  title        = {{Improper input handling in MongoDB Python GridFS rename lets attackers access or delete other files.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-88029},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-88029/}}
}