mongorestore may restore encoded collection names into an unintended collection

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filename has been truncated. A database user who can create and populate a suitably encoded collection can cause a later authorized directory restore to write those documents into a different collection that the user cannot modify directly. When both collection names resolve to the same destination, backed-up documents may be omitted; use of --drop can also replace the unintended destination collection. Exploitation requires an operator to restore the affected collection from a directory dump with write access to the destination. This issue affects MongoDB Database Tools versions 100.0.2 through versions before 100.20.1.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md Diğer

Kayıt geçmişi

1. 3 Kas 2026 19:21Yayımlandı

İlgili açıklar

• 2,8 CVE-2026-119673mongofiles may write outside the working directory through a symlink
• 4,8 CVE-2026-119672mongofiles may disclose GridFS content to standard output through a stored filename
• 8,6 CVE-2026-119675MongoDB Database Tools mongorestore: system.buckets öneki ile koleksiyon korumasının aşılması
• 6,8 CVE-2026-116641MongoDB Database Tools: eMudhra ara CA sertifikalarına yanlış güven
• 5,3 CVE-2026-118663@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
• 5,9 CVE-2026-118655Echo: Static Middleware Double-Unescape Path Traversal