{"action":"Upgrade mongodb/mongodb to 1.24.5 or later.","affected":[{"fixed":"1.24.5","introduced":"1.1.0"},{"fixed":"2.4.2","introduced":"2.0.0"}],"component":"mongodb/mongodb","cve_ids":["CVE-2026-88023"],"ecosystem":"Packagist","epss":0.00326,"exploited":false,"fixed_versions":["1.24.5","2.4.2"],"ghsa_id":"GHSA-8fxw-fmj8-xp7j","id":"tcs_01M5KEZ068PEX1J9WRZWEG09AC","modified_at":"2026-10-05T23:45:08.870612235Z","published_at":"2026-10-05T23:26:58Z","references":["https://osv.dev/vulnerability/GHSA-8fxw-fmj8-xp7j","https://github.com/mongodb/mongo-php-library/security/advisories/GHSA-8fxw-fmj8-xp7j","https://nvd.nist.gov/vuln/detail/CVE-2026-88023","https://github.com/mongodb/mongo-php-library/pull/1981","https://github.com/mongodb/mongo-php-library/commit/8c0b165069ab29d52a80a379a947ac9a55734601","https://github.com/mongodb/mongo-php-library","https://github.com/mongodb/mongo-php-library/releases/tag/1.21.5","https://github.com/mongodb/mongo-php-library/releases/tag/2.4.2","https://jira.mongodb.org/browse/PHPLIB-1929"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-8fxw-fmj8-xp7j","url":"https://osv.dev/vulnerability/GHSA-8fxw-fmj8-xp7j"}],"summary":"MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs"}