Improper neutralization of special elements in a query causes a caller‑supplied structured file identifier to be treated as a query condition instead of a literal id. This allows an attacker to read files beyond the intended target, delete all GridFS file chunks in a bucket, or rename an unintended file. The flaw rooted in GridFS query logic therefore threatens both confidentiality and integrity of stored content.

The vulnerability affects the MongoDB Python Driver, specifically its GridFS component. Any application that uses this driver to access GridFS buckets and constructs file identifiers from user input is potentially impacted.

The classifies this as a moderate severity vulnerability. EPSS data is unavailable and the issue is not listed in the CISA KEV catalog. The obvious attack vector involves an authenticated user who can provide or influence the file identifier passed to the driver—typically a remote attacker with application credentials. Successful exploitation can lead to unauthorized data disclosure, unwanted deletion, or renaming of GridFS files.