https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 05 Nov 2026 22:48:31 +0000 https://db.gcve.eu/vuln/cve-2026-119673 <p><strong>Affected:</strong> MongoDB Database Tools</p> <p>MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for get_regex. An unauthorized user who can both upload a GridFS file and place a symlink in the operator&#39;s download working directory can cause a later retrieval to create a file containing unauthorized user-controlled data outside that directory, using the operator process&#39;s filesystem permissions. The issue can occur with default traversal and overwrite settings. Exploitation requires an operator to retrieve matching files from the affected working directory; the demonstrated default behavior creates a new file rather than overwriting an existing file. This issue affects MongoDB Database Tools versions 100.2.0 through versions before 100.20.1.</p> <p><strong>Affected:</strong> MongoDB Database Tools</p> <p>MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for get_regex. An unauthorized user who can both upload a GridFS file and place a symlink in the operator&#39;s download working directory can cause a later retrieval to create a file containing unauthorized user-controlled data outside that directory, using the operator process&#39;s filesystem permissions. The issue can occur with default traversal and overwrite settings. Exploitation requires an operator to retrieve matching files from the affected working directory; the demonstrated default behavior creates a new file rather than overwriting an existing file. This issue affects MongoDB Database Tools versions 100.2.0 through versions before 100.20.1.</p> https://db.gcve.eu/vuln/cve-2026-119673