CVE-2026-119672
Description
A flaw was found in mongo-tools. This vulnerability allows information disclosure when the mongofiles utility retrieves files without a specified local destination, defaulting to the filename recorded in database metadata. An authenticated user capable of modifying file metadata can set the filename to write to standard output. If a higher-privileged user then downloads the file in an environment where standard output is captured or logged, the attacker can view sensitive file contents they are not permitted to access directly.
Statement
This vulnerability is evaluated with a Moderate impact for Red Hat products rather than a higher severity because exploitation demands significant attacker prerequisites and does not allow direct unauthorized data extraction. The flaw only manifests when a privileged administrator executes the interactive mongofiles command-line utility to fetch stored GridFS items without providing a destination path flag. Furthermore, the attacker must already possess permissions to alter object properties in the database and have secondary access to console streams or system logs capturing the operator's execution output.
Understanding the Weakness (CWE)
Integrity,Confidentiality
Technical Impact: Read Files or Directories
The application can operate on unexpected files, such as system files or configuration files. Confidentiality is violated when the targeted filename is not directly readable by the attacker.
Integrity,Confidentiality,Availability
Technical Impact: Modify Files or Directories; Execute Unauthorized Code or Commands
The application can operate on unexpected files. This may violate integrity if the filename is written to, or if the filename is for a program or other form of executable code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (Other)
The application can operate on unexpected files. Availability can be violated if the attacker specifies an unexpected file that the application modifies. Availability can also be affected if the attacker specifies a filename for a large file, or points to a special device or a file that does not have the format that the application expects.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
