The vulnerability arises from improper neutralization of special elements in data query logic within the GridFS component of the MongoDB Python Driver. Specifically, a caller-supplied structured file identifier may be interpreted as a query condition rather than a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. Additionally, the affected rename operation may rename a stored file other than the intended target. The affected versions are from 1.6.0 up to but not including 4.18.1.

An authenticated user with the ability to influence file identifiers can exploit this vulnerability to access unauthorized stored file content, delete all file chunks in a GridFS bucket, or rename files other than the intended target. This compromises data confidentiality and integrity within applications using the affected MongoDB Python Driver versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor MongoDB's official advisories for updates. In the meantime, restrict authenticated user privileges to limit influence over file identifiers and validate or sanitize inputs used in GridFS operations to prevent injection of special query elements.