The vulnerability arises from improper neutralization of special elements in data query logic within the GridFS component of the MongoDB Python Driver. Specifically, a structured file identifier supplied by a caller is interpreted as a query condition rather than as a literal identifier. This flaw allows an authenticated user with influence over the identifier to retrieve unauthorized stored file content, remove all file chunks in the bucket, or rename files other than the intended target. The issue affects the rename operation and file retrieval logic in GridFS.

An authenticated user who can control the file identifier passed to the affected application may gain unauthorized access to stored file content beyond the intended file. They may also cause denial of service by deleting all GridFS file chunks in the bucket, rendering stored files unreadable. Additionally, the rename operation may affect files other than the intended target, potentially causing data integrity issues.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, applications should carefully validate and sanitize any user-supplied identifiers used in GridFS operations to prevent injection of query conditions. Restricting access to authenticated users with minimal privileges may reduce risk.