Is CVE-2026-119672 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119672 being exploited in the wild.

How severe is CVE-2026-119672?

Medium severity, with a CVSS score of 4.8, published 3 November 2026.

Which products and versions are affected?

MongoDB Database Tools 3.1.4 through before 100.20.1.

Is there a fix for CVE-2026-119672?

Yes: fixed in MongoDB Database Tools 100.20.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119672 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-119672?

Check whether you run MongoDB Database Tools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119672: MongoDB Database Tools mongofiles path traversal in GridFS output

CVE-2026-119672 · Severity: medium · CVSS 4.8 · Published 2026-11-03

MongoDB Database Tools is a command-line utility for managing MongoDB databases, including the mongofiles tool for working with GridFS file storage. An attacker with database write access can manipulate file metadata to redirect output to standard output by setting a filename to '-', potentially exposing GridFS content that the attacker cannot directly read if that output is captured. Exploitation requires a privileged operator to retrieve the file and the attacker to access the captured output.

Technologies: MongoDB Database Tools. Vendors: MongoDB.

Quick answers

Is CVE-2026-119672 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119672 being exploited in the wild.
How severe is CVE-2026-119672?: Medium severity, with a CVSS score of 4.8, published 3 November 2026.
Which products and versions are affected?: MongoDB Database Tools 3.1.4 through before 100.20.1.
Is there a fix for CVE-2026-119672?: Yes: fixed in MongoDB Database Tools 100.20.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119672 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-119672?: Check whether you run MongoDB Database Tools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: MongoDB Database Tools 100.20.1

Technical details

The mongofiles get_id command uses a database-stored GridFS filename as the output destination when the --local flag is not specified, failing to validate that the filename is safe. An attacker who can modify GridFS file metadata can set the filename to '-', causing the tool to write file contents to stdout instead of a file. This is a path traversal / output redirection vulnerability requiring authenticated database write access and relies on stdout being captured in a location the attacker can access.

Affected products

MongoDB Database Tools 3.1.4 through before 100.20.1

Timeline

2026-11-03: disclosed

References

https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.