EUVD-2026-116027

MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for getid when --local is not specified. A user who can modify the file metadata can set the stored filename to '-', causing a later authorized retrieval to write the file contents to standard outpu...

CVE-2026-119672 mongofiles may disclose GridFS content to standard output through a stored filename

MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for getid when --local is not specified. A user who can modify the file metadata can set the stored filename to '-', causing a later authorized retrieval to write the file contents to standard outpu...

CVE-2026-119672

The mongofiles component of MongoDB Database Tools (versions 3.1.4 through before 100.20.1) is vulnerable to information disclosure. The root cause is that mongofiles uses a database-stored GridFS filename as the output destination for get_id when the --local flag is omitted. An attacker capable ...

CVE-2026-119672: MongoDB Database Tools: MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for get_id when…

MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for getid when --local is not specified. A user who can modify the file metadata can set the stored filename to '-', causing a later authorized retrieval to write the file contents to standard outpu...