Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader (CVE-2026-13078)

MongoDB Server contains a vulnerability (CVE-2026-13078) in its MozJS scripting engine where a module loading hook is unconditionally registered. This enables JavaScript code executed within the server to read arbitrary files on the host filesystem using the mongod process's privileges. An authenticated attacker can exploit this by sending specially crafted aggregation pipeline commands to read sensitive files accessible to the server process. The vulnerability affects versions >=7.0.0 <7.0.39, >=8.0.0 <8.0.28, >=8.2.0 <8.2.12, and >=8.3.0 <8.3.7. No known exploits in the wild have been reported. A patch is available to remediate the issue.

An authenticated user can read arbitrary files on the MongoDB server host with the permissions of the mongod process. This could lead to exposure of sensitive information stored on the server filesystem. The vulnerability does not allow unauthenticated access and requires valid authentication to exploit.

A patch is available for this vulnerability. Users should upgrade affected MongoDB Server versions to the fixed releases at or beyond 7.0.39, 8.0.28, 8.2.12, and 8.3.7 to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.