CVE-2026-13078

Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader

State: Published
Severity: 6.3 Medium
Published: Jul 22, 2026
Updated: Jul 23, 2026
Reserved: Jun 23, 2026

Description

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N	mongodb
3.1	7.7 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N	mongodb

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
MongoDB ServerMongoDB	7.0 to before 7.0.39Affected 8.0 to before 8.0.28Affected 8.2.0 to before 8.2.12Affected 8.3.0 to before 8.3.7Affected

References

https://jira.mongodb.org/browse/SERVER-128832

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.