mongofiles may write outside the working directory through a symlink

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for get_regex. An unauthorized user who can both upload a GridFS file and place a symlink in the operator's download working directory can cause a later retrieval to create a file containing unauthorized user-controlled data outside that directory, using the operator process's filesystem permissions. The issue can occur with default traversal and overwrite settings. Exploitation requires an operator to retrieve matching files from the affected working directory; the demonstrated default behavior creates a new file rather than overwriting an existing file. This issue affects MongoDB Database Tools versions 100.2.0 through versions before 100.20.1.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md Diğer

Kayıt geçmişi

1. 3 Kas 2026 19:14Yayımlandı

İlgili açıklar

• 3,7 CVE-2026-119674mongorestore may restore encoded collection names into an unintended collection
• 4,8 CVE-2026-119672mongofiles may disclose GridFS content to standard output through a stored filename
• 8,6 CVE-2026-119675MongoDB Database Tools mongorestore: system.buckets öneki ile koleksiyon korumasının aşılması
• 6,8 CVE-2026-116641MongoDB Database Tools: eMudhra ara CA sertifikalarına yanlış güven
• 4,7 CVE-2026-122235Jan 0.8.5 before 0.8.8 Workspace Guard Bypass via Dangling Symlink
• 4,4 CVE-2026-122136Powerlevel10k before 1.20.19 Symlink Following via Instant Prompt Temporary File