{"id":"CVE-2026-119674","published":"2026-11-03T17:18:06.967","lastModified":"2026-11-03T20:00:56.300","description":"MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filename has been truncated. A database user who can create and populate a suitably encoded collection can cause a later authorized directory restore to write those documents into a different collection that the user cannot modify directly. When both collection names resolve to the same destination, backed-up documents may be omitted; use of --drop can also replace the unintended destination collection. Exploitation requires an operator to restore the affected collection from a directory dump with write access to the destination. This issue affects MongoDB Database Tools versions 100.0.2 through versions before 100.20.1.","cvssScore":3.7,"cvssSeverity":"LOW","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L","cwes":["CWE-174"],"vendors":[],"products":[],"references":[{"url":"https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md","tags":[]}],"exploitRefs":[{"url":"https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md","tags":[]}],"hasPoc":true,"ai":null}