UpHeron
All vulnerabilities

Servers and applications

CVE-2026-13078

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB…

Severity
Medium 6.3
Published
22 Jul 2026
Last changed
18 Aug 2026
Added to UpHeron
21 Oct 2026
Fixed in
7.0.39, 8.0.28, 8.2.12, 8.3.7
Sources
NVD

Affected software

SoftwareAffected versions
MongoDBServers and applications · cpe:a:mongodb:mongodb
  • From 7.0.0 before 7.0.39
  • From 8.0.0 before 8.0.28
  • From 8.2.0 before 8.2.12
  • From 8.3.0 before 8.3.7

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-13078
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-13078