MongoDB Database Tools mongofiles can use a database‑stored GridFS filename as the output location for the get_id operation when the --local flag is omitted. A privileged user who can modify the file’s metadata can set the stored filename to the string ‘-’, which causes mongofiles to write the file contents to standard output instead of to a local file. If the attacker can capture that standard output in a location they can later read, the contents of the GridFS file may be disclosed even though the attacker does not have direct read permission on the file. This flaw directly allows the exposure of data to an attacker via an unintended output channel.

MongoDB Database Tools, edition Database Tools, version range 3.1.4 through any release before 100.20.1. The vulnerability is present in all releases within this range regardless of configuration, provided the --local option is omitted during file retrieval.

The CVSS score of 5.9 reflects a moderate confidence that the flaw can lead to data disclosure. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, suggesting it has not been widely targeted so far. Exploitation requires a higher‑privileged operator to invoke mongofiles and retrieve the affected file without specifying a local destination, and the attacker must have prior access to the location where the captured standard output is stored. In practice, the threat is limited to scenarios where an attacker controls output capture or has read access to the capture destination, but if that condition is met, the vulnerability can expose sensitive GridFS data.