AIKIDO-2026-656127

TL;DR

GridFS read, delete, and abort operations in the mongo gem build MongoDB filters directly from a caller supplied file ID without requiring an exact match. A Hash value such as one containing a $gt or MinKey operator is interpreted as query criteria instead of a literal identifier, so a single ID lookup can match chunks belonging to other files in the bucket. This lets a Hash shaped ID disclose the contents of unrelated files or delete chunks across the whole bucket instead of just the intended file. The fix wraps every ID in $eq across the read, delete, and abort paths so only exact matches apply.