Mongodb Php Library
Monthly
NoSQL injection (CWE-943) in the MongoDB PHP Library's GridFS component allows a low-privileged authenticated user who can influence the file identifier parameter to achieve three distinct impacts: reading file content beyond the intended target, deleting all GridFS file chunks within a bucket (rendering stored files unrecoverable), or renaming an unintended file. The CVSS 4.0 vector (AT:P) confirms exploitation depends on the target application routing attacker-influenced input directly into GridFS operations without sanitization. No public exploit or CISA KEV listing has been identified at time of analysis.
NoSQL injection (CWE-943) in the MongoDB PHP Library's GridFS component allows a low-privileged authenticated user who can influence the file identifier parameter to achieve three distinct impacts: reading file content beyond the intended target, deleting all GridFS file chunks within a bucket (rendering stored files unrecoverable), or renaming an unintended file. The CVSS 4.0 vector (AT:P) confirms exploitation depends on the target application routing attacker-influenced input directly into GridFS operations without sanitization. No public exploit or CISA KEV listing has been identified at time of analysis.