All vulnerabilities
CVE-2026-88029GHSA-8fvv-fgr5-f8chPYSEC-2026-4294

pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods

MongoDB pymongopipDatabases
Open in ThreatlineRecord JSON
CVSS
6.1Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 17% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.18.1Fixed versionGitHub
Published10 Sep 2026Updated 15 Oct 2026CVE List

What fixes it

  • 4.18.1pymongo, pipGitHub
  • 4.18.1Python DriverCVE List
  • 4.18.1pymongo, PyPIOSVpip install "pymongo>=4.18.1"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

When reading/writing via an ID with the GridFS API, require an exact match on the given ID. Otherwise, if a Hash is given in place of the ID, it may be interpreted as criteria, overriding the ID match.

Patches

Patch available in pymongo >= 4.18.1

Workarounds

Ensure your existing workflow _only_ supports exact matching on the GridFS API.

Text from GitHub Advisory Database

Affected versions 53

  • pymongo, pip<= 4.18.0GitHub
  • Python Driveraffected: 1.6.0 before 4.18.1CVE List
  • pymongo, PyPIfrom first release, fixed in 4.18.1OSV
  • pymongo, PyPI0.1.1preOSV
  • pymongo, PyPI0.1.2preOSV
  • pymongo, PyPI0.10OSV
  • pymongo, PyPI0.10.1OSV
  • pymongo, PyPI0.10.2OSV
  • pymongo, PyPI0.10.3OSV
  • pymongo, PyPI0.11OSV
  • pymongo, PyPI0.11.1OSV
  • pymongo, PyPI0.11.2OSV
  • pymongo, PyPI0.11.3OSV
  • pymongo, PyPI0.12OSV
  • pymongo, PyPI0.13OSV
  • pymongo, PyPI0.14OSV
  • pymongo, PyPI0.14.1OSV
  • pymongo, PyPI0.14.2OSV
  • pymongo, PyPI0.15OSV
  • pymongo, PyPI0.15.1OSV
  • pymongo, PyPI0.15.2OSV
  • pymongo, PyPI0.16OSV
  • pymongo, PyPI0.1preOSV
  • pymongo, PyPI0.2preOSV
  • pymongo, PyPI0.3.1preOSV
  • pymongo, PyPI0.3preOSV
  • pymongo, PyPI0.4preOSV
  • pymongo, PyPI0.5.1preOSV
  • pymongo, PyPI0.5.2preOSV
  • pymongo, PyPI0.5.3preOSV
  • pymongo, PyPI0.5preOSV
  • pymongo, PyPI0.6OSV
  • pymongo, PyPI0.7OSV
  • pymongo, PyPI0.7.1OSV
  • pymongo, PyPI0.7.2OSV
  • pymongo, PyPI0.8OSV
  • pymongo, PyPI0.8.1OSV
  • pymongo, PyPI0.9OSV
  • pymongo, PyPI0.9.1OSV
  • pymongo, PyPI0.9.2OSV
  • pymongo, PyPI0.9.3OSV
  • pymongo, PyPI0.9.4OSV
  • pymongo, PyPI0.9.5OSV
  • pymongo, PyPI0.9.6OSV
  • pymongo, PyPI0.9.7OSV
  • pymongo, PyPI1.0OSV
  • pymongo, PyPI1.1OSV
  • pymongo, PyPI1.1.1OSV
  • pymongo, PyPI1.1.2OSV
  • pymongo, PyPI1.10OSV
  • pymongo, PyPI1.10.1OSV
  • pymongo, PyPI1.11OSV
  • pymongo, PyPI1.2OSV

References 9