Use exact match for file ID in GridFS delete methods (port to main branch)

XMLWordPrintableJSON

    • Type: Task
    • Resolution: Unresolved
    • Priority: Critical - P2
    • 4.0.0
    • Affects Version/s: None
    • Component/s: None
    • None
    • None
    • Dotnet Drivers
    • None
    • None
    • None
    • None
    • None
    • None

      The fix for CSHARP-6190 shipped in 3.11.2 on the v3.x branch only. The main branch still builds GridFS id filters as {_id: id} and

      {files_id: id}

      without an explicit $eq, so a structured file id is interpreted as a query predicate and 4.0.0 would ship the same issue.

      Port the v3.x fix (commit 53e865892f159ae2c61f69f2203ac6da4c02ff16) to main, along with its tests and the GridFS spec test updates.

      See CSHARP-6190 and DRIVERS-3607 for the full analysis. Released as CVE-2026-88025.

            Assignee:
            Ferdinando Papale
            Reporter:
            Adelin Mbida Owona
            None
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated: