1. Home
  2. CVE Database
  3. CVE-2026-13078
HIGH · 7.7

CVE-2026-13078

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files fro...

Vulnerability Description

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process.

CVSS Score

7.7

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
MongodbMongodb>= 7.0.0, < 7.0.39

Related Weaknesses (CWE)

CWE-862

References

FAQ

What is CVE-2026-13078?

CVE-2026-13078 is a vulnerability with a CVSS score of 7.7 (HIGH). A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files fro...

How severe is CVE-2026-13078?

CVE-2026-13078 has been rated HIGH with a CVSS base score of 7.7/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-13078?

Check the references section above for vendor advisories and patch information. Affected products include: Mongodb Mongodb.