GHSA-8fvv-fgr5-f8ch

pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-88029

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	pymongo	< 4.18.1	4.18.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact When reading/writing via an ID with the GridFS API, require an exact match on the given ID. Otherwise, if a Hash is given in place of the ID, it may be interpreted as criteria, overriding the ID match. ### Patches Patch available in pymongo >= 4.18.1 ### Workarounds Ensure your existing workflow _only_ supports exact matching on the GridFS API.

References

External links from the advisory. They lead to third-party sites.

https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-8fvv-fgr5-f8ch web
https://nvd.nist.gov/vuln/detail/CVE-2026-88029 advisory
https://github.com/mongodb/mongo-python-driver/pull/3046 web
https://github.com/mongodb/mongo-python-driver/commit/3ef1c607859589a0086446ad6f557791a2813681 web
https://github.com/mongodb/mongo-python-driver/commit/fa676586ba4b399168a4d1d41c30dc2166cc44fd web
https://github.com/mongodb/mongo-python-driver package
https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.1 web
https://jira.mongodb.org/browse/PYTHON-5992 web