CVE-2026-13078 is a local file disclosure vulnerability in MongoDB Server affecting the MozJS scripting engine module loader. The server-side MozJS engine unconditionally registers a module loading hook, which allows JavaScript code executed within the server context to read arbitrary files from the host filesystem with the privileges of the mongod process. An authenticated user can exploit this by sending specially crafted aggregation pipeline commands to the server, thereby accessing sensitive files accessible to the MongoDB server process. This vulnerability affects multiple MongoDB versions and has a moderate severity rating.

An authenticated attacker can read arbitrary files on the host filesystem with the privileges of the MongoDB server process. This could lead to disclosure of sensitive information stored on the server, potentially impacting confidentiality. There is no indication of remote unauthenticated exploitation or privilege escalation beyond the mongod process privileges.

A patch is available for this vulnerability. Users should upgrade affected MongoDB Server versions to the fixed releases to remediate the issue. Since this is not a cloud service, remediation requires applying the patch on self-managed deployments. No vendor advisory content contradicts this guidance.