{"id":"CVE-2026-119674","title":"mongorestore may restore encoded collection names into an unintended collection","summary":"MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filename has been truncated. A database user who can create and populate a suitably encoded collection…","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L","cvssSource":"cna","cwe":["CWE-174"],"vendor":"MongoDB","product":"Database Tools","affected":["database_tools >= 100.0.2 < 100.20.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-03T17:38:32.169861Z"},"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T17:38:44.072Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119674","references":[{"url":"https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md"}],"tags":["cve.org"],"epss":0.00163,"epssPercentile":0.05561,"ingestedAt":"2026-11-05T20:33:06.325Z","slug":"CVE-2026-119674","body":"## Overview\n\nMongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filename has been truncated. A database user who can create and populate a suitably encoded collection can cause a later authorized directory restore to write those documents into a different collection that the user cannot modify directly. When both collection names resolve to the same destination, backed-up documents may be omitted; use of --drop can also replace the unintended destination collection. Exploitation requires an operator to restore the affected collection from a directory dump with write access to the destination. This issue affects MongoDB Database Tools versions 100.0.2 through versions before 100.20.1.\n\n## Affected\n\n- `database_tools >= 100.0.2 < 100.20.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":20.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}