# CVE-2026-119673: mongofiles may write outside the working directory through a symlink

> CVE-2026-119673: mongofiles may write outside the working directory through a symlink. CVSS 2.8 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-119673
Last updated: 2026-11-03T20:00:56Z

- Published: 2026-11-03 16:14 UTC · Updated: 2026-11-03 20:00 UTC · Assigner: mongodb
- CVSS: 2.8 (CVSS 3.1) · Severity: Low · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
- EPSS: 0.15%, 4th percentile (scored 2026-11-04)
- CISA KEV: no
- CWE: CWE-59

## Description

MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for get\_regex. An unauthorized user who can both upload a GridFS file and place a symlink in the operator's download working directory can cause a later retrieval to create a file containing unauthorized user-controlled data outside that directory, using the operator process's filesystem permissions. The issue can occur with default traversal and overwrite settings. Exploitation requires an operator to retrieve matching files from the affected working directory; the demonstrated default behavior creates a new file rather than overwriting an existing file. This issue affects MongoDB Database Tools versions 100.2.0 through versions before 100.20.1.

## Affected vendors and products

- MongoDB: Database Tools

## Tracked companies

- [MongoDB Atlas](https://rewindex.com/company/mongodb-atlas.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-119673)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-119673)
- [https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md](https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-119673 · Markdown: https://rewindex.com/cve/CVE-2026-119673.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-119673 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-05T15:28:15.505Z