The vulnerability resides in the server-side MozJS scripting engine of MongoDB Server, where a module loading hook is registered without validation, allowing JavaScript code to read any file accessible to the mongod process. This flaw provides an authenticated attacker the ability to execute crafted aggregation pipelines that expose sensitive files, thereby compromising confidentiality of data that should be protected by the operating system and MongoDB permissions. The weakness is a classic example of an improper authorization defect (CWE-862).

MongoDB Server is affected. The vendor/product list indicates that all versions of MongoDB Server that include the MozJS engine may be vulnerable; no specific version range is supplied by the CNA, so the exact scope is unknown and should be inspected against your deployment.

The CVSS score of 6.3 indicates a moderate severity. The EPSS score of <1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not actively exploited. The probable attack vector is via an authenticated user who can manipulate the aggregation pipeline to trigger the module loader. Because the attack requires authentication, an attacker would need valid MongoDB credentials and the ability to craft aggregation commands, which are typically restricted to privileged users.