CVEFinder.io

CVE-2024-7553

⚠️ high
Summary

Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to

Description

Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1.

Required Configuration:

Only environments with Windows as the underlying operating system is affected by this issue

CVSS Score
7.3
High
EPSS Score
0.2
Exploit Probability
Published Date
2024-08-07
First Seen: 2026-01-05
πŸ“Š Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 54.3% of all 365,968 vulnerabilities in our database.

#167,192
Above average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Aug 7, 2024
πŸ” Exploitation Status
None
No known exploits
βš™οΈ Automatable
NO
Requires human interaction
πŸ’₯ Technical Impact
Total
Complete system compromise possible
πŸ† Discovered By
T. Doğa Gelişli
SSVC data provided by CISA
Last Modified 2024-09-19
Source NVD πŸ”—
CVSS Vector 3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)
CWE-284

πŸ“¦ Affected Products 6

Vendor Product Status Affected Versions
mongodb mongodb Affected
≥ 5.0.0 < 5.0.27
mongodb mongodb Affected
≥ 6.0.0 < 6.0.16
mongodb mongodb Affected
≥ 7.0.0 < 7.0.12
mongodb mongodb Affected
≥ 7.3.0 < 7.3.3
mongodb c_driver Affected
< 1.26.2
mongodb php_driver Affected
< 1.18.1

πŸ”— References 3

https://jira.mongodb.org/browse/CDRIVER-5650
Vendor Advisory
https://jira.mongodb.org/browse/PHPC-2369
Vendor Advisory
https://jira.mongodb.org/browse/SERVER-93211
Vendor Advisory

πŸ”— Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-93393 ⚠️ high 8.1 0.5 A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platf... 2026-09-17
CVE-2026-93394 ℹ️ low 3.7 0.3 A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and... 2026-09-17
CVE-2026-93395 πŸ”Ά medium 5.3 0.4 A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when proc... 2026-09-17
CVE-2026-89099 ⚠️ high 7.5 0.3 A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the sam... 2026-09-11
CVE-2026-88035 πŸ”Ά medium 4.7 0.1 A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-... 2026-09-10
CVE-2026-88036 ⚠️ high 8.3 0.3 Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can caus... 2026-09-10
These CVEs affect the same products