This vulnerability arises from improper neutralization of special elements in data query logic within the GridFS component of the MongoDB Go Driver. Specifically, a caller-supplied structured file identifier can be interpreted as a query condition rather than a literal identifier. An authenticated user who can influence the identifier passed by an application using the affected driver versions may exploit this to delete all GridFS file chunks in the targeted bucket, resulting in data loss or unreadable stored files. The affected versions are MongoDB Go Driver versions >=1.0.0 <1.17.10 and >=2.0.0 <2.9.1. The CVSS 4.0 score is 6.1, indicating a medium severity vulnerability.

An authenticated user with the ability to influence the file identifier can cause all GridFS file chunks in the affected bucket to be removed. This leads to the stored file content becoming unreadable, effectively causing data loss or denial of access to stored files within the application using the vulnerable MongoDB Go Driver versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, applications should carefully validate and sanitize any user-influenced identifiers passed to GridFS operations to prevent them from being interpreted as query conditions.