CVE-2026-119673 in Database Tools
Summary
by MITRE • 11/03/2026
MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for get_regex. An unauthorized user who can both upload a GridFS file and place a symlink in the operator's download working directory can cause a later retrieval to create a file containing unauthorized user-controlled data outside that directory, using the operator process's filesystem permissions. The issue can occur with default traversal and overwrite settings. Exploitation requires an operator to retrieve matching files from the affected working directory; the demonstrated default behavior creates a new file rather than overwriting an existing file. This issue affects MongoDB Database Tools versions 100.2.0 through versions before 100.20.1.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in MongoDB Database Tools, specifically within the mongofiles utility during get_regex operations, represents a critical path traversal and symlink following flaw that undermines filesystem isolation boundaries. This issue stems from an insufficient validation mechanism when resolving output paths for file retrieval operations. When the tool processes regular expressions to locate files stored in GridFS, it fails to properly canonicalize or resolve existing parent-directory symbolic links before determining the final destination for downloaded content. In a typical secure implementation, any path resolution logic must normalize directory structures and ensure that no component of the target path escapes the intended working directory through symlink manipulation. The absence of this rigorous validation allows an attacker who has control over symlinks within or adjacent to the operator's download working directory to redirect file writes outside of the sandboxed environment.
From a technical perspective, the core flaw lies in how mongofiles handles path construction during the retrieval phase. While default settings for traversal and overwrite are designed to prevent accidental data loss by creating new files rather than overwriting existing ones, this behavior does not mitigate the risk of unauthorized file creation outside the designated directory. An attacker with the ability to upload GridFS files can also place a symbolic link in the operator's working directory that points to an arbitrary location on the filesystem where the mongofiles process has write permissions. When an authorized user or automated system executes a get_regex command targeting specific patterns, the tool resolves the symlink and writes the retrieved data to the target of the link rather than within the expected local folder. This effectively bypasses access controls intended by directory scoping, allowing unauthorized users to inject controlled content into sensitive areas of the file system using the elevated privileges of the operator process.
The operational impact of this vulnerability is significant for environments relying on MongoDB Database Tools for automated data management or administrative tasks. Since exploitation requires an operator to retrieve matching files from the affected working directory, it targets workflows where human interaction or scheduled jobs trigger these retrieval commands. The ability to write arbitrary data outside the intended directory can lead to various downstream consequences depending on what resides in those external locations. This could include overwriting configuration files, injecting malicious scripts into web-accessible directories, or corrupting system logs and other critical infrastructure components. Because the file is created rather than overwritten by default, it may evade simple integrity checks that look for modifications to existing files, making detection more difficult without comprehensive filesystem monitoring.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as it allows an actor to access directories outside the restricted set through symlink manipulation. Furthermore, from a threat modeling perspective consistent with MITRE ATT&CK frameworks, this behavior facilitates lateral movement and privilege escalation by allowing unauthorized data placement in locations that may be processed by other services running under higher privileges. It also relates to CWE-59: Improper Link Resolution Before File Access, highlighting the failure to validate symbolic links prior to performing file operations. The attack vector is classified as local or network-dependent depending on how GridFS access is exposed, but it generally requires initial low-level access to upload files and manipulate symlinks within a shared workspace.
Mitigation strategies must prioritize upgrading MongoDB Database Tools to version 100.20.1 or later, where this path resolution logic has been corrected to properly resolve and validate parent-directory symlinks before determining output paths. In environments where immediate patching is not feasible, administrators should enforce strict filesystem permissions that limit the write capabilities of the mongofiles process to only its designated working directory, preventing writes even if symlink redirection occurs. Additionally, implementing file integrity monitoring on critical system directories can help detect unauthorized file creations resulting from such exploitation attempts. Organizations should also review GridFS access controls to ensure that upload privileges are granted only to trusted users and processes, reducing the attack surface available for placing malicious symlinks in operator working directories.