Improper handling of file identifiers in the GridFS component of the MongoDB PHP Library allows a caller‑supplied identifier to be treated as a query operator instead of a literal value. This flaw is a CWE-943 vulnerability—improper neutralization of special elements in data query logic. When an authenticated user can influence the identifier sent by an application, the attacker may obtain content from unintended files, delete all chunks in a bucket, or rename a file that was not targeted. The vulnerability can lead to confidentiality loss, data loss, and availability impact on stored files that rely on GridFS.

All installations of the MongoDB PHP Library that use GridFS for file storage are affected. The specific version or patch level is not disclosed in the input. Attackers must be able to authenticate to the application that uses the library.

The CVSS score is 6.1, reflecting moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated user influencing file identifiers through the application. Exploitation requires the attacker to be granted application access; however, once achieved, the impact can be significant due to direct manipulation of file objects.