MongoDB Database Tools EUVD-2026-116031

Four concrete prerequisites must all hold: (1) a low-privileged but authenticated database user able to create and populate a collection with a crafted URL-encoded name; (2) the dump filename for that collection must be truncated so mongorestore re-reads and URL-decodes the original name from metadata; (3) both the crafted and original collection names must resolve to the same destination after decoding; and (4) an operator must subsequently perform an authorized directory-based restore with write access to the destination. Limiting factors that reduce real-world risk: the attacker cannot act alone and depends on an operator-initiated restore (UI:P), needs authenticated low-privilege access (PR:L), and relies on the specific truncation/collision condition (AT:P). Impact is amplified when the operator uses --drop. Affected: MongoDB Database Tools 100.0.2 through before 100.20.1 (fixed in 100.20.1).

This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The vendor-supplied CVSS 4.0 base score is 2.1 (Low) with vector AV:N/AC:L/AT:P/PR:L/UI:P and impact limited to VI:L/VA:L (no confidentiality, no subsequent-system impact), and the vuln.today decision label is 'monitor'. There is no CISA KEV listing, no EPSS figure was supplied, and the only reference is the project CHANGELOG - not a proof-of-concept - so exploitation status is 'no public exploit identified at time of analysis'. The AT:P and UI:P metrics reflect that the attacker cannot complete the attack alone: success depends on a separate operator-initiated restore plus a specific filename-truncation and name-collision condition. My independent read agrees with the vendor that impact is integrity/availability, not disclosure, despite the 'Information Disclosure' tag (CVSS shows VC:N). Net: a real but narrow data-integrity defect worth patching on a normal maintenance cycle, not an emergency.

A low-privileged database user creates and populates a collection whose name is URL-encoded so that, after the dump filename is truncated, it decodes to collide with a collection the user cannot modify directly. When an operator later runs an authorized directory-based mongorestore with write access to that destination, the attacker's documents are written into the privileged collection (or legitimately backed-up documents are silently omitted); using --drop can replace the unintended destination collection entirely. No public exploit code exists - the only reference is the vendor CHANGELOG.