# CVE-2026-13078: Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader

> CVE-2026-13078: Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader. CVSS 7.7 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-13078
Last updated: 2026-10-24T13:10:00Z

- Published: 2026-07-22 19:11 UTC · Updated: 2026-10-24 13:10 UTC · Assigner: mongodb
- CVSS: 7.7 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- EPSS: 0.37%, 31th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-862

## Description

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process.

## Affected vendors and products

- MongoDB: MongoDB Server

## Tracked companies

- [MongoDB Atlas](https://rewindex.com/company/mongodb-atlas.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-13078)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-13078)
- [https://jira.mongodb.org/browse/SERVER-128832](https://jira.mongodb.org/browse/SERVER-128832)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-13078 · Markdown: https://rewindex.com/cve/CVE-2026-13078.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-13078 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:15:59.705Z