This vulnerability arises from improper neutralization of special elements in data query logic within the GridFS component of the MongoDB C++ Driver. Specifically, a caller-supplied structured file identifier is interpreted as a query condition rather than a literal identifier. An authenticated user who can influence the identifier passed by an affected application may exploit this to access unauthorized stored file content or cause deletion of all GridFS file chunks in the bucket, impacting data integrity and confidentiality. The affected versions are from 3.2.0 up to but not including 4.5.3.

An authenticated user with limited privileges can exploit this vulnerability to read stored file content beyond their intended access or delete all GridFS file chunks in the affected bucket. This compromises data confidentiality and availability by allowing unauthorized data access and potential data loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, applications should carefully validate and sanitize any user-supplied identifiers used in GridFS queries to prevent interpretation as query conditions. Restricting user privileges and monitoring application behavior may help reduce risk.