UBUNTU-CVE-2026-119673

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-119673

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-119673.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-119673

Upstream

CVE-2026-119673

Published

2026-11-03T17:18:00Z

Modified

2026-11-05T11:46:08Z

Severity

2.8 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
1.0 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for get_regex. An unauthorized user who can both upload a GridFS file and place a symlink in the operator's download working directory can cause a later retrieval to create a file containing unauthorized user-controlled data outside that directory, using the operator process's filesystem permissions. The issue can occur with default traversal and overwrite settings. Exploitation requires an operator to retrieve matching files from the affected working directory; the demonstrated default behavior creates a new file rather than overwriting an existing file. This issue affects MongoDB Database Tools versions 100.2.0 through versions before 100.20.1.

References

Affected packages

Ubuntu:18.04:LTS / mongo-tools

Package

Name: mongo-tools
Purl: pkg:deb/ubuntu/mongo-tools?arch=source&distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.2.11-1

3.2.11-1ubuntu1

3.4.14-1

3.4.14-2

3.6.3-0ubuntu1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "mongo-tools",
            "binary_version": "3.6.3-0ubuntu1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-119673.json"

Ubuntu:20.04:LTS / mongo-tools