A vulnerability in MongoDB Database Tools mongofiles allows an unauthorized user to exploit symlink resolution issues in parent directories when retrieving files. This can lead to creation of files with unauthorized user-controlled data outside the intended directory, leveraging the operator process's filesystem permissions. The issue affects versions from 100.2.0 up to but not including 100.20.1 and requires the operator to retrieve files from the affected directory.