278 matches found
CVE-2026-120955
A flaw was found in the MongoDB C Driver. The GridFS file retrieval component does not properly check the results of internal operations under certain error conditions. A remote attacker who can influence file download parameters can trigger this flaw to terminate the application process, leading...
CVE-2026-120955
The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this...
CVE-2026-120684
A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area can arrange conditions under which an...
CVE-2026-120955
The MongoDB C Driver 's GridFS file download API, specifically the mongoc_gridfs_bucket_download_to_stream() function, contains a vulnerability where it fails to check the result of an internal operation during certain error conditions. This flaw allows a user capable of influencing file download...
CVE-2026-120955 MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata
The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this...
EUVD-2026-116137
The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this...
CVE-2026-120955 MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata
The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this...
CVE-2026-120684
A memory-initialization flaw exists in the legacy GridFS file handling of the MongoDB C Driver . This vulnerability allows uninitialized process memory to be treated as valid file content and stored on the server. A database user with ordinary write access to a shared storage area can trigger con...
CVE-2026-120684 MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password
A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area can arrange conditions under which an...
CVE-2026-120684 MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password
A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area can arrange conditions under which an...
EUVD-2026-116134
A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area can arrange conditions under which an...
CVE-2026-119673
MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for getregex. An unauthorized user who can both upload a GridFS file and place a symlink in the operator's download working directory can cause a later retrieval to create a file...
CVE-2026-119672
MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for getid when --local is not specified. A user who can modify the file metadata can set the stored filename to '-', causing a later authorized retrieval to write the file contents to standard outpu...
EUVD-2026-116027
MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for getid when --local is not specified. A user who can modify the file metadata can set the stored filename to '-', causing a later authorized retrieval to write the file contents to standard outpu...
CVE-2026-119672 mongofiles may disclose GridFS content to standard output through a stored filename
MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for getid when --local is not specified. A user who can modify the file metadata can set the stored filename to '-', causing a later authorized retrieval to write the file contents to standard outpu...
CVE-2026-119672 mongofiles may disclose GridFS content to standard output through a stored filename
MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for getid when --local is not specified. A user who can modify the file metadata can set the stored filename to '-', causing a later authorized retrieval to write the file contents to standard outpu...
CVE-2026-119672
The mongofiles component of MongoDB Database Tools (versions 3.1.4 through before 100.20.1) is vulnerable to information disclosure. The root cause is that mongofiles uses a database-stored GridFS filename as the output destination for get_id when the --local flag is omitted. An attacker capable ...
CVE-2026-119672: MongoDB Database Tools: MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for get_id when…
MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for getid when --local is not specified. A user who can modify the file metadata can set the stored filename to '-', causing a later authorized retrieval to write the file contents to standard outpu...
PT-2026-136346
Name of the Vulnerable Software and Affected Versions MongoDB C Driver versions 1.25.0 through 1.30.14 MongoDB C Driver versions 2.0.0 through 2.5.7 Description A denial-of-service issue exists in the GridFS file download API. The mongoc gridfs bucket download to stream function fails to check th...
CVE-2026-48204
CVE-2026-48204 — camel-mongodb-gridfs gridfs. Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus|...