CVE-2026-119674
Received Received - Intake

MongoDB Database Tools mongorestore Directory Traversal Vulnerability

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: MongoDB, Inc.

Description
MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filename has been truncated. A database user who can create and populate a suitably encoded collection can cause a later authorized directory restore to write those documents into a different collection that the user cannot modify directly. When both collection names resolve to the same destination, backed-up documents may be omitted; use of --drop can also replace the unintended destination collection. Exploitation requires an operator to restore the affected collection from a directory dump with write access to the destination. This issue affects MongoDB Database Tools versions 100.0.2 through versions before 100.20.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-119674
EUVD
EUVD-2026-116031

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
MongoDB Database Tools 100.0.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-174 The product decodes the same input twice, which can limit the effectiveness of any protection mechanism that occurs in between the decoding operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filename has been truncated. This allows a user who can create and populate a suitably encoded collection to cause documents to be written into a different collection during a restore operation. If both collection names resolve to the same destination, backed-up documents may be omitted. Use of the --drop option can also replace the unintended destination collection.

Detection Guidance

This vulnerability is specific to MongoDB Database Tools mongorestore functionality and requires checking the version of the tools installed. Use the command mongorestore --version to verify if your version is between 100.0.2 and before 100.20.1.

Impact Analysis

This vulnerability can lead to data loss or corruption if an attacker manipulates collection names during a restore operation. It may cause documents to be written to unintended collections or omitted entirely. Operators restoring affected collections could unknowingly overwrite or lose data.

Compliance Impact

This vulnerability could impact compliance by potentially exposing or altering sensitive data during restore operations. GDPR requires data integrity and protection; HIPAA mandates secure handling of health information. Unauthorized data changes or loss could violate these regulations.

Mitigation Strategies

Upgrade MongoDB Database Tools to version 100.20.1 or later to address the vulnerability. Ensure that only trusted users have write access to directories used for database restores.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119674. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...