The MongoDB C# Driver GridFS component improperly neutralizes special elements in data query logic, causing a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal identifier. This flaw allows an authenticated user who can control the identifier input to potentially access stored file content beyond the intended file, delete all file chunks in the affected bucket, or rename files other than the intended target. The vulnerability affects versions >=2.3.0 and <=3.11.1. No known exploits in the wild have been reported. The CVSS 4.0 vector indicates network attack vector, low attack complexity, partial privileges required, no user interaction, low confidentiality impact, high integrity and availability impacts.

An authenticated user with the ability to influence the file identifier parameter may access unauthorized stored file content, delete all GridFS file chunks in the affected bucket causing data loss, or rename files other than the intended target. This can lead to unauthorized data disclosure, data integrity compromise, and denial of access to stored files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to limit influence over file identifiers in GridFS operations and monitor application behavior for unexpected file access or modifications.