The vulnerability arises from improper neutralization of special elements in the data query logic within the GridFS component of the MongoDB Ruby Driver. Specifically, a caller-supplied structured file identifier is interpreted as a query condition rather than a literal identifier. This can be exploited by an authenticated user able to influence the identifier passed by an application using the affected driver, potentially allowing unauthorized access to stored files or deletion of all file chunks in the GridFS bucket.

An authenticated attacker with the ability to influence the file identifier can obtain access to stored file content beyond what is intended or cause all GridFS file chunks in the affected bucket to be removed. This results in unauthorized data disclosure and denial of access to stored files due to deletion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, applications should carefully validate and sanitize any user-influenced identifiers passed to GridFS operations to prevent injection of query conditions.