Accessing Untrusted Directory May Allow Local Privilege Escalation
Priority LOW 36CWE-284Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.
Summary
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1. Required Configuration: Only environments with Windows as the underlying operating system is affected by this issue
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0026 17th percentileScored 2026-11-07
Fix Fixed MongoDB Server (MongoDB Inc): 5.0.27, 6.0.16, 7.0.12 +1MongoDB C Driver (MongoDB Inc): 1.26.2+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MongoDB | MongoDB Server | 5.0 to before 5.0.27; 6.0 to before 6.0.16; 7.0 to before 7.0.12; 7.3 to before 7.3.3 | 5.0.27, 6.0.16, 7.0.12, 7.3.3 | Patch available | CNA |
| MongoDB | MongoDB C Driver | before 1.26.2 | 1.26.2 | Patch available | CNA |
| MongoDB | MongoDB PHP Driver | before 1.18.1 | 1.18.1 | Patch available | CNA |
- MongoDB Server VendorMongoDB Affected 5.0 to before 5.0.27; 6.0 to before 6.0.16; 7.0 to before 7.0.12; 7.3 to before 7.3.3 Fixed in 5.0.27, 6.0.16, 7.0.12, 7.3.3 Patch available CNA
- MongoDB C Driver VendorMongoDB Affected before 1.26.2 Fixed in 1.26.2 Patch available CNA
- MongoDB PHP Driver VendorMongoDB Affected before 1.18.1 Fixed in 1.18.1 Patch available CNA
CPE configurations NVD · 25
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:* | 5.0.0 to before 5.0.27 | Vulnerable | MongoDB |
| cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:* Versions 5.0.0 to before 5.0.27 Vulnerable ·MongoDB
- cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
Show 15 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:microsoft:windows_10_2004:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_20h2:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_21h1:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:* | 6.0.0 to before 6.0.16; 7.0.0 to before 7.0.12; 7.3.0 to before 7.3.3 | Vulnerable | MongoDB |
| cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_21h2:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_22h2:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:mongodb:c_driver:*:*:*:*:*:mongodb:*:* | before 1.26.2 | Vulnerable | MongoDB |
| cpe:2.3:a:mongodb:php_driver:*:*:*:*:*:mongodb:*:* | before 1.18.1 | Vulnerable | MongoDB |
- cpe:2.3:o:microsoft:windows_10_2004:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_20h2:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_21h1:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:* Versions 6.0.0 to before 6.0.16; 7.0.0 to before 7.0.12; 7.3.0 to before 7.3.3 Vulnerable ·MongoDB
- cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_21h2:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_22h2:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:mongodb:c_driver:*:*:*:*:*:mongodb:*:* Versions before 1.26.2 Vulnerable ·MongoDB
- cpe:2.3:a:mongodb:php_driver:*:*:*:*:*:mongodb:*:* Versions before 1.18.1 Vulnerable ·MongoDB
Remediation
- Fix · CNA MongoDB Server (MongoDB Inc) Fixed in 5.0.27, 6.0.16, 7.0.12, 7.3.3
- Fix · CNA MongoDB C Driver (MongoDB Inc) Fixed in 1.26.2
- Fix · CNA MongoDB PHP Driver (MongoDB Inc) Fixed in 1.18.1
Timeline
- 2026-10-02 Threatist record created from CVE-2024-7553
- 2026-10-03 Alias added: GHSA-5m47-pw5x-gvrc
References
More MongoDB C Driver vulnerabilities
- TI-2026-62966 Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream CVSS 4.0CRITICAL 9.2
- TI-2026-05870 MongoDB C Driver Cyrus SASL Canonicalization Buffer Overflow CVSS 4.0HIGH 8.6
- TI-2026-62968 Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer() CVSS 4.0MEDIUM 6.9
- TI-2026-58387 Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client CVSS 4.0HIGH 8.2
- TI-2023-00414 MongoDB client C Driver may infinitely loop when validating certain BSON input data CVSS 3.1HIGH 7.5
- TI-2026-58386 Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser CVSS 4.0MEDIUM 6.3
Sources
- CVE-2024-7553 · CVE Program
- CVE-2024-7553 · NVD
- FIRST EPSS
- GHSA-5m47-pw5x-gvrc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences