MongoDB Database Tools Vulnerability Exposes GridFS Contents

CVE-2026-119672

What is CVE-2026-119672?

A vulnerability in MongoDB Database Tools allows for inappropriate handling of GridFS stored filenames. When the --local flag isn't specified, a malicious user with the ability to alter file metadata can manipulate the output destination during the retrieval process. If the stored filename is set to '-', the file content can be sent to standard output, potentially exposing sensitive GridFS data to unauthorized users. This exploitation relies on a combination of permissions, where both an elevated operator must retrieve the affected file and the attacker must gain access to the captured output stream. This vulnerability impacts versions ranging from 3.1.4 up to, but not including, 100.20.1.

References