The vulnerability arises from improper neutralization of special elements in data query logic within the GridFS component of the MongoDB C Driver. Specifically, a caller-supplied structured file identifier may be interpreted as a query condition rather than a literal identifier. This flaw can be exploited by an authenticated user who can control the identifier passed by an application using the affected driver versions, potentially leading to unauthorized access to stored file content or deletion of all GridFS file chunks in the bucket.

An authenticated user with the ability to influence the file identifier can retrieve stored file content beyond the intended target or cause deletion of all GridFS file chunks in the affected bucket, resulting in data exposure or loss of stored files. The CVSS 4.0 base score is 6.1 (medium severity), reflecting the need for authentication and limited scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Users should monitor MongoDB's official advisories for updates and consider restricting access to authenticated users who can influence file identifiers until a fix is available.