mongofiles fails to resolve existing parent‑directory symlinks when validating output paths for get_regex, a flaw classified as CWE‑59. An attacker who can upload a GridFS file and place a symlink in the operator's download working directory can cause the operator process to create a new file containing user‑controlled data outside that directory. The operator process then writes the file using its own filesystem permissions, which may result in unauthorized data creation or modification, potentially exposing sensitive data or corrupting system files.

The vulnerability affects MongoDB Database Tools. Versions from 100.2.0 up to, but not including, 100.20.1 are impacted. Users of these releases should verify the installed version against the stated range.

The CVSS score is 1, indicating a very low severity rating. EPSS is not available and the flaw is not listed in the CISA KEV catalog. Exploitation requires an attacker who can upload files to GridFS on the same host as the operator and place a symlink in the download working directory; it then relies on the operator to retrieve matching files. This attack vector is local, but it could allow an attacker to create arbitrary files with the operator’s filesystem permissions, posing a potential integrity risk to the host.