Name: CVE-2026-88030: Improper Neutralization of Special Elements in Data Query Logic
Creator: Rapid7
Published: 2026-09-10T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-88030, CWE-943, CVSS 8.3, EPSS 0.00265

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

CVSS Details

CVSS 4.0 Base Score: 6.1 (MEDIUM)
CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
CVSS 3.1 Base Score: 8.3
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade rubygem-bundlerUpgrade rubygem-opensslUpgrade rubygem-mysql2Upgrade ruby-docUpgrade ruby-irbUpgrade rubygem-net-telnetUpgrade rubygem-psychUpgrade ruby-develUpgrade rubygem-minitestUpgrade rubygem-abrtUpgrade rubygem-pgUpgrade rubyUpgrade rubygem-power_assertUpgrade rubygemsUpgrade ruby-libsUpgrade rubygem-pg-docUpgrade rubygem-bsonUpgrade rubygem-bundler-docUpgrade rubygem-mongoUpgrade rubygem-jsonUpgrade rubygem-rakeUpgrade rubygem-test-unitUpgrade rubygem-bigdecimalUpgrade rubygem-bson-docUpgrade rubygem-io-consoleUpgrade rubygem-rdocUpgrade rubygem-did_you_meanUpgrade rubygem-mongo-docUpgrade rubygem-abrt-docUpgrade rubygem-mysql2-docUpgrade rubygem-xmlrpcUpgrade rubygems-devel	Oct 11, 2026	Sep 30, 2026
Oracle_linux	—	Upgrade rubygem-io-consoleUpgrade rubygem-bson-docUpgrade rubygem-rakeUpgrade rubygem-psychUpgrade rubygem-rdocUpgrade rubygem-bigdecimalUpgrade ruby-irbUpgrade ruby-docUpgrade rubygem-bsonUpgrade rubygem-xmlrpcUpgrade rubygem-mongo-docUpgrade rubygems-develUpgrade rubygem-test-unitUpgrade rubygem-did_you_meanUpgrade rubygem-mysql2-docUpgrade rubygem-pg-docUpgrade rubygemsUpgrade rubygem-bundler-docUpgrade rubygem-power_assertUpgrade rubygem-mysql2Upgrade rubygem-minitestUpgrade rubygem-jsonUpgrade ruby-develUpgrade rubygem-opensslUpgrade rubygem-net-telnetUpgrade rubygem-abrt-docUpgrade ruby-libsUpgrade rubygem-pgUpgrade rubygem-bundlerUpgrade rubyUpgrade rubygem-abrtUpgrade rubygem-mongo	Oct 22, 2026	Sep 10, 2026
Redhat_linux	—	Upgrade rubygem-bundlerUpgrade rubygem-opensslUpgrade rubygem-psychUpgrade rubygem-bsonUpgrade rubygem-psych-debuginfoUpgrade ruby-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-abrtUpgrade ruby-libsUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade rubygem-did_you_meanUpgrade ruby-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-bundler-docUpgrade rubygem-test-unitUpgrade ruby-docUpgrade rubygem-openssl-debuginfoUpgrade rubyUpgrade rubygemsUpgrade rubygem-abrt-docUpgrade rubygem-xmlrpcUpgrade rubygem-bigdecimalUpgrade rubygem-io-console-debuginfoUpgrade rubygems-develUpgrade rubygem-pg-docUpgrade rubygem-minitestUpgrade rubygem-json-debuginfoUpgrade rubygem-rakeUpgrade rubygem-rdocUpgrade rubygem-power_assertUpgrade rubygem-bson-debuginfoUpgrade rubygem-pgUpgrade rubygem-mysql2-docUpgrade ruby-irbUpgrade rubygem-bson-debugsourceUpgrade rubygem-bson-docUpgrade rubygem-net-telnetUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mongoUpgrade ruby-develUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimal-debuginfo	Sep 16, 2026	Sep 10, 2026
Rocky_linux	—	Upgrade rubygem-io-consoleUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-pgUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-psych-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-mysql2Upgrade ruby-develUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-opensslUpgrade rubygem-bsonUpgrade rubyUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-openssl-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-psych	Oct 5, 2026	Oct 1, 2026

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence