Name: CVE-2026-88030: Improper Neutralization of Special Elements in Data Query Logic
Creator: Rapid7
Published: 2026-09-10T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-88030, CWE-943, CVSS 8.3, EPSS 0.00265

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

CVSS Details

CVSS 4.0 Base Score: 6.1 (MEDIUM)
CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
CVSS 3.1 Base Score: 8.3
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade rubygem-mysql2Upgrade rubygem-bundlerUpgrade rubygem-opensslUpgrade rubyUpgrade rubygem-mongoUpgrade rubygem-minitestUpgrade rubygem-pgUpgrade rubygem-abrtUpgrade ruby-docUpgrade rubygemsUpgrade rubygem-power_assertUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade ruby-irbUpgrade rubygem-pg-docUpgrade ruby-libsUpgrade rubygem-bundler-docUpgrade rubygem-bsonUpgrade ruby-develUpgrade rubygem-net-telnetUpgrade rubygem-xmlrpcUpgrade rubygem-mongo-docUpgrade rubygem-bigdecimalUpgrade rubygem-did_you_meanUpgrade rubygem-mysql2-docUpgrade rubygem-abrt-docUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade rubygem-test-unitUpgrade rubygems-develUpgrade rubygem-bson-docUpgrade rubygem-rdoc	Oct 11, 2026	Sep 30, 2026
Redhat_linux	—	Upgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mongoUpgrade rubygem-mysql2-docUpgrade ruby-irbUpgrade rubygem-pgUpgrade rubygem-bson-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygems-develUpgrade rubygem-bson-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-io-console-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-pg-docUpgrade rubygem-bson-docUpgrade ruby-develUpgrade rubygem-net-telnetUpgrade rubygem-rdocUpgrade rubygem-rakeUpgrade rubygem-minitestUpgrade rubyUpgrade ruby-libsUpgrade ruby-debugsourceUpgrade rubygem-abrtUpgrade rubygem-xmlrpcUpgrade rubygem-did_you_meanUpgrade rubygem-test-unitUpgrade rubygemsUpgrade rubygem-mysql2Upgrade rubygem-opensslUpgrade rubygem-psychUpgrade rubygem-pg-debugsourceUpgrade rubygem-mongo-docUpgrade rubygem-jsonUpgrade rubygem-bundler-docUpgrade rubygem-mysql2-debugsourceUpgrade ruby-debuginfoUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade rubygem-bsonUpgrade rubygem-abrt-docUpgrade ruby-libs-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-openssl-debuginfo	Sep 16, 2026	Sep 10, 2026
Rocky_linux	—	Upgrade ruby-develUpgrade ruby-debuginfoUpgrade rubygem-bsonUpgrade rubygem-bson-debuginfoUpgrade rubygem-jsonUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-psych-debuginfoUpgrade rubygem-opensslUpgrade ruby-libsUpgrade rubygem-openssl-debuginfoUpgrade rubyUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-json-debuginfoUpgrade rubygem-pgUpgrade ruby-libs-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-bigdecimalUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debugsource	Oct 5, 2026	Oct 1, 2026

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence