---
id: CVE-2026-119673
title: mongofiles may write outside the working directory through a symlink
summary: >-
  MongoDB Database Tools mongofiles does not resolve existing parent-directory
  symlinks when validating output paths for get_regex. An unauthorized user who
  can both upload a GridFS file and place a symlink in the operator's download
  worki…
severity: low
cvss: 2.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-59
vendor: MongoDB
product: Database Tools
affected:
  - database_tools >= 100.2.0 < 100.20.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T17:44:11.306438Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T17:44:21.089Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119673'
references:
  - url: 'https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md'
tags:
  - cve.org
epss: 0.00147
epssPercentile: 0.03946
ingestedAt: '2026-11-05T20:33:06.328Z'
---

## Overview

MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for get_regex. An unauthorized user who can both upload a GridFS file and place a symlink in the operator's download working directory can cause a later retrieval to create a file containing unauthorized user-controlled data outside that directory, using the operator process's filesystem permissions. The issue can occur with default traversal and overwrite settings. Exploitation requires an operator to retrieve matching files from the affected working directory; the demonstrated default behavior creates a new file rather than overwriting an existing file. This issue affects MongoDB Database Tools versions 100.2.0 through versions before 100.20.1.

## Affected

- `database_tools >= 100.2.0 < 100.20.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.