---
id: CVE-2026-119674
title: >-
  mongorestore may restore encoded collection names into an unintended
  collection
summary: >-
  MongoDB Database Tools mongorestore incorrectly URL-decodes an original
  collection name read from metadata when the corresponding dump filename has
  been truncated. A database user who can create and populate a suitably encoded
  collection…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-174
vendor: MongoDB
product: Database Tools
affected:
  - database_tools >= 100.0.2 < 100.20.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T17:38:32.169861Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T17:38:44.072Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119674'
references:
  - url: 'https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md'
tags:
  - cve.org
epss: 0.00163
epssPercentile: 0.05561
ingestedAt: '2026-11-05T20:33:06.325Z'
---

## Overview

MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filename has been truncated. A database user who can create and populate a suitably encoded collection can cause a later authorized directory restore to write those documents into a different collection that the user cannot modify directly. When both collection names resolve to the same destination, backed-up documents may be omitted; use of --drop can also replace the unintended destination collection. Exploitation requires an operator to restore the affected collection from a directory dump with write access to the destination. This issue affects MongoDB Database Tools versions 100.0.2 through versions before 100.20.1.

## Affected

- `database_tools >= 100.0.2 < 100.20.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.