# CVE-2026-119673: mongofiles may write outside the working directory through a symlink

Status: published. Published: 2026-11-03. Updated: 2026-11-03.

MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for get_regex. An unauthorized user who can both upload a GridFS file and place a symlink in the operator's download working directory can cause a later retrieval to create a file containing unauthorized user-controlled data outside that directory, using the operator process's filesystem permissions. The issue can occur with default traversal and overwrite settings. Exploitation requires an operator to retrieve matching files from the affected working directory; the demonstrated default behavior creates a new file rather than overwriting an existing file. This issue affects MongoDB Database Tools versions 100.2.0 through versions before 100.20.1.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- MongoDB / Database Tools: ≥ 100.2.0; < 100.20.1 (affected, semver). Source: CNA: mongodb

## Severity and prioritization

- CVSS 4.0: 1 (low); CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N; source: CNA: mongodb

- CVSS 3.1: 2.8 (low); CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N; source: CNA: mongodb

- CVSS 4.0: 1 (low); CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source: NVD: cna@mongodb.com

- CVSS 3.1: 2.8 (low); CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N; source: NVD: cna@mongodb.com

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-59

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md (CNA: mongodb)

- https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md (cna@mongodb.com)

## Provenance

- CNA: mongodb: https://www.cve.org/CVERecord?id=CVE-2026-119673; retrieved 2026-11-03; source updated 2026-11-03

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-119673; retrieved 2026-11-04; source updated 2026-11-03

Revision: 069580039ef4f8ba6eaa502c093ec821cbaf41a8d5e6d0a577cd214afbaf0be0

Canonical: https://y2.dev/cve/CVE-2026-119673

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.