Updated advisory posts against rubysec/ruby-advisory-db@f08b5bf

Author: jasnow

advisories/_posts/2026-09-10-CVE-2026-88030.md

@@ -0,0 +1,47 @@
+---
+layout: advisory
+title: 'CVE-2026-88030 (mongo): MongoDB Ruby Driver - Improper neutralization of special
+  elements in data query logic in the GridFS component'
+comments: false
+categories:
+- mongo
+advisory:
+  gem: mongo
+  cve: 2026-88030
+  ghsa: 4ww7-gqv6-mffc
+  url: https://nvd.nist.gov/vuln/detail/CVE-2026-88030
+  title: MongoDB Ruby Driver - Improper neutralization of special elements in data
+    query logic in the GridFS component
+  date: 2026-09-10
+  description: |-
+    Improper neutralization of special elements in data query logic in
+    the GridFS component of the MongoDB Ruby Driver can cause a
+    caller-supplied structured file identifier to be interpreted as a
+    query condition rather than as a literal identifier. An authenticated
+    user who can influence the identifier passed by an affected application
+    may obtain stored file content beyond the intended target or cause
+    all GridFS file chunks in the affected bucket to be removed,
+    rendering stored file content unreadable.
+  cvss_v3: 8.3
+  cvss_v4: 6.1
+  unaffected_versions:
+  - "< 2.0.0"
+  patched_versions:
+  - ">= 2.26.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-88030
+    - https://rubygems.org/gems/mongo/versions/2.26.0
+    - https://github.com/mongodb/mongo-ruby-driver/releases/tag/v2.26.0
+    - https://github.com/mongodb/mongo-ruby-driver/pull/3105
+    - https://github.com/mongodb/mongo-ruby-driver/commit/ed62bb56c2e24c79113709331862d0aa3da74c6d
+    - https://jira.mongodb.org/browse/RUBY-3941
+    - https://github.com/advisories/GHSA-4ww7-gqv6-mffc
+  notes: |
+    - cvss_v4 from GHSA and nvd.nist.gov URLs.
+    - cvss_v3 from nvd.nist.gov URLs.
+    - Found "Use exact match for file ID in GridFS methods (CVE-2026-88030)"
+      reference above in commit and releases/tag URLs.
+    - NOTE: gem name is "mongo" and repo name is "mongo-ruby-driver".
+    - This is an unreviewed GHSA advisory.
+---