Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119672— mongofiles may disclose GridFS content to standard output through a stored filename

Quick assessment

Affected
MongoDB Database Tools
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MongoDB 数据库工具中的 组件在 命令未指定 参数时，会将存储在数据库中的 GridFS 文件名用作输出目标。若攻击者能够修改文件元数据，即可将存储的文件名设置为 ，从而导致后续具有授权权限的检索操作将文件内容写入标准输出，而非本地文件。如果该标准输出被捕获并存储在该攻击者可访问的位置，则可能泄露攻击者无法直接读取的 GridFS 内容。利用此漏洞需要满足两个条件：一是由更高权限的管理员在不指定显式本地目标的情况下检索受影响的文件；二是攻击者能够访问被捕获的标准输出。该漏洞影响从 3.1.4 版本起至 100

CVSS 4.8 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119672

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
mongofiles may disclose GridFS content to standard output through a stored filename
Source: CVE Program / CVE List V5
Vulnerability Description
MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for get_id when --local is not specified. A user who can modify the file metadata can set the stored filename to '-', causing a later authorized retrieval to write the file contents to standard output instead of a local file. If standard output is captured in a location accessible to that user, this may disclose GridFS content the user cannot read directly. Exploitation requires a higher-privileged operator to retrieve the affected file without an explicit local destination and attacker access to the captured output. This issue affects MongoDB Database Tools from version 3.1.4 through versions before 100.20.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
文件名或路径的外部可控制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MongoDB Database Tools 3.1.4 ~ 100.20.1 -

II. Public POCs for CVE-2026-119672

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119672

请登录查看更多情报信息。

Other References for CVE-2026-119672 (1)

Same Patch Batch · MongoDB · 2026-11-03 · 12 CVEs total

CVE-2026-119675 8.6 HIGH mongorestore may bypass collection guards through a system.buckets prefix
CVE-2026-120678 7.5 HIGH mongo-c-driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to pa
CVE-2026-120955 7.5 HIGH MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Applicatio
CVE-2026-120956 7.1 HIGH remote abort and memory disclosure from a malformed cursor.ns
CVE-2026-119179 7.0 HIGH MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expo
CVE-2026-120684 6.5 MEDIUM MongoDB C Driver 2.5.5 GridFS gap lets arotected client's password
CVE-2026-120673 5.5 MEDIUM Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command
CVE-2026-120953 4.3 MEDIUM Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-co
CVE-2026-119674 3.7 LOW mongorestore may restore encoded collection names into an unintended collection
CVE-2026-120954 3.7 LOW Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views
CVE-2026-119673 2.8 LOW mongofiles may write outside the working directory through a symlink

IV. Related Vulnerabilities

Same product: Database Tools
Same vendor: MongoDB
Same weakness: CWE-73