The MongoDB Rust Driver's GridFS component improperly neutralizes special elements in data query logic, causing a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal identifier. This flaw allows an authenticated user who can control the identifier passed by an application to either access stored file content beyond the intended target or delete all GridFS file chunks in the affected bucket, rendering the stored content unreadable. The vulnerability affects versions >=2.4.0 and <3.9.1. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

An authenticated user with the ability to influence the file identifier can access unauthorized stored file content or cause deletion of all GridFS file chunks in the affected bucket, resulting in loss of access to stored files. This can lead to unauthorized data disclosure and data availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, applications should carefully validate and sanitize identifiers passed to the GridFS component to prevent injection of query conditions. Monitor vendor communications for patches or official mitigations.