MongoDB Database Tools EUVD-2026-116028

Exploitation requires all of the following concrete conditions: (1) the attacker can upload a GridFS file to the MongoDB instance; (2) the attacker can place a symlink in the operator's mongofiles download working directory; and (3) an operator subsequently runs a mongofiles get_regex retrieval that matches files in that affected working directory. The flaw works with the default traversal and overwrite settings, and the demonstrated default behavior creates a NEW file rather than overwriting an existing one. Limiting factors that reduce realistic risk: the attack vector is local (AV:L) and needs filesystem write access to the operator's working directory, it requires low-privilege access to upload the GridFS file (PR:L), and it cannot succeed without the operator performing the retrieval action (passive user interaction, UI:P).

All decision signals point to very low real-world risk. The vendor-assigned CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:P) with a base score of 1.0 reflects a local-only issue that requires a present attack condition, low-privilege access, and passive user interaction, with impact limited to VI:L (low integrity) and no confidentiality or availability effect. The vuln.today decision label is 'monitor' - the lowest urgency tier. No EPSS probability, no CISA KEV listing, and no proof-of-concept are present in the supplied data, so there is no evidence of exploitation interest. The only reference is the vendor CHANGELOG, not an exploit. The signals are internally consistent (low CVSS + monitor + no KEV/EPSS/POC all agree), so this is a genuinely low-priority, defense-in-depth hardening fix rather than a high-CVSS-but-overlooked threat. The only caveat is a metadata conflict: the description calls the actor an 'unauthorized user,' yet the CVSS vector encodes PR:L (some privilege), reflecting that the attacker still needs the ability to upload a GridFS file and write a symlink into the operator's working directory - verify the exact access model with MongoDB if that distinction matters to your environment.

A low-privileged actor who can upload a GridFS file and place a symlink in the operator's mongofiles download working directory waits for an operator to run a get_regex retrieval. Because mongofiles does not resolve existing parent-directory symlinks when validating the output path, the retrieval follows the planted symlink and creates a file containing attacker-controlled data outside the intended directory, using the operator process's filesystem permissions. No public exploit identified at time of analysis; exploitation depends on operator action and local access to the working directory.