Directory Traversal Vulnerability in MongoDB Database Tools

CVE-2026-119673

What is CVE-2026-119673?

A vulnerability in MongoDB Database Tools mongofiles allows unauthorized users to exploit symlink behaviors. When resolving output paths for get_regex, the tool fails to properly validate existing parent-directory symlinks. If an unauthorized user can upload a GridFS file and place a symlink within the download working directory of the operator, it can lead to unauthorized access to sensitive files. Subsequently, this can result in the creation of files containing data controlled by the unauthorized user outside the intended directory, while leveraging the file system permissions assigned to the operator process. The vulnerability is especially concerning with the default traversal settings, as retrieval of matching files leads to new file creation rather than overwriting existing files. This issue affects versions from 100.2.0 up to, but not including, 100.20.1.

References