Vulnerabilities

TI-2026-84405 CVE-2026-119674 · GHSA-px68-pqg4-8q7x

mongorestore may restore encoded collection names into an unintended collection

LOW 10

MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filename has been truncated.

CVSS 4.0LOW 2.1 Network Low privileges User interaction EPSS 0.00163 Published 2026-11-03 Partial fix · 100.20.1 CWE-174

TI-2026-84397 CVE-2026-119673 · GHSA-3jx2-r7fh-fm2g

MongoDB mongofiles symlink flaw writes files outside working directory

LOW 6

MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for get_regex.

CVSS 4.0LOW 1.0 Local Low privileges User interaction EPSS 0.00147 Published 2026-11-03 Partial fix · 100.20.1 CWE-59

TI-2026-84396 CVE-2026-119672 · GHSA-vj7x-r9xp-w7fv

mongofiles may disclose GridFS content via stored filename

LOW 26

MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for get_id when --local is not specified.

CVSS 4.0MEDIUM 5.9 Network Low privileges User interaction EPSS 0.00226 Published 2026-11-03 Fixed in 100.20.1 CWE-73

TI-2026-84398 CVE-2026-119675 · GHSA-fg58-w2p8-9j7f

Collection guard bypass in MongoDB Database Tools mongorestore

LOW 25

MongoDB Database Tools mongorestore inconsistently handles the system.buckets.

CVSS 4.0MEDIUM 5.2 Local No auth User interaction EPSS 0.00174 Published 2026-11-03 Partial fix · 100.20.1 CWE-706

Vulnerabilities

Filters

mongorestore may restore encoded collection names into an unintended collection

MongoDB mongofiles symlink flaw writes files outside working directory

mongofiles may disclose GridFS content via stored filename

Collection guard bypass in MongoDB Database Tools mongorestore