MongoDB Java Driver CVE-2026-88033

Three conditions must simultaneously be true for exploitation: (1) the target application uses the MongoDB Java Driver's GridFS client API for file storage operations (find, rename, or delete); (2) the application accepts externally-supplied input (e.g., from an authenticated HTTP request) and passes that input as the file identifier argument to a GridFS operation without first validating it as a plain ObjectId literal; and (3) the attacker holds at least low-privilege authenticated access to the application (PR:L per CVSS). Applications that use GridFS but derive all file identifiers from internal state (e.g., database-generated ObjectIds that are never echoed back to or accepted from users) are not exploitable. No special platform, non-default MongoDB configuration, or network position is required beyond an authenticated application session.

The CVSS 4.0 score of 6.1 (Medium) with vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H reflects a nuanced picture: while integrity and availability impacts on the vulnerable system are rated High (file deletion and arbitrary rename), the AT:P (attack requirements present) metric acknowledges that exploitation is conditional on a specific application code pattern. Practically, this means the risk is not universal - only applications that use the MongoDB Java Driver's GridFS API and pass user-controlled input as file identifiers without sanitization are exposed. EPSS data is absent from the provided intelligence; KEV status is negative and no POC is publicly referenced, indicating no confirmed active exploitation or weaponized proof-of-concept at time of analysis. The availability impact is particularly severe: deletion of all file chunks in a bucket is a destructive, potentially irreversible action if backups are absent. The confidentiality impact is rated Low (limited to content readable within the affected bucket rather than cross-bucket or server-wide). Real-world risk is moderate to high for applications with the vulnerable code pattern but low for deployments that do not expose GridFS identifiers to user input.

An attacker with a low-privilege account in an application backed by MongoDB Java Driver submits a crafted file identifier - for example, a JSON object containing a $exists or $gt operator - through a feature such as a file download or rename endpoint. The Java Driver constructs a BSON filter that interprets this as a query condition, matching all files in the GridFS bucket rather than the specific file. Depending on which operation is triggered, the attacker can dump the contents of all matched file chunks (information disclosure) or invoke a delete that strips all chunk documents from the bucket, permanently destroying stored content for all users.