mongorestore incorrectly URL‑decodes a collection name read from metadata when the corresponding dump filename has been truncated. This flaw causes an administrator who restores a dump to write documents into an unintended collection, potentially dropping or overwriting backed‑up documents when a drop option is used. The primary impact is loss or corruption of data integrity and availability, rather than remote code execution or privilege escalation.

MongoDB Database Tools versions 100.0.2 through 100.20.1 are vulnerable. The issue resides in the mongorestore utility and affects any environment that performs directory restores using those tool versions.

The CVSS score of 2.1 indicates a low severity. EPSS data is not available and the vulnerability is not listed in CISA KEV. Exploitation requires that the attacker can create and populate a collection with an encoded name and that an operator subsequently performs a directory restore with write access to the destination. Therefore the attack vector is inferred to be an authorized restoration process; the scope is limited to the database user who can initiate the restore, making exploitation unlikely in uncontrolled environments.