CVE-2026-119673

The mongofiles utility in MongoDB Database Tools (versions 100.2.0 through before 100.20.1) contains a vulnerability where it fails to resolve existing parent-directory symlinks when validating output paths for get_regex . This flaw allows an unauthorized user who can upload a GridFS file and pla...

CVE-2026-119673 mongofiles may write outside the working directory through a symlink

MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for getregex. An unauthorized user who can both upload a GridFS file and place a symlink in the operator's download working directory can cause a later retrieval to create a file...

EUVD-2026-116028

MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for getregex. An unauthorized user who can both upload a GridFS file and place a symlink in the operator's download working directory can cause a later retrieval to create a file...

CVE-2026-119673: MongoDB Database Tools: MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for…

MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for getregex. An unauthorized user who can both upload a GridFS file and place a symlink in the operator's download working directory can cause a later retrieval to create a file...