high7.8
CVE-2025-10491
The MongoDB Windows installation MSI may leave ACLs unset on custom installation directories allowing a local attacker to introduce executable code to MongoDB'…
Impact
The MongoDB Windows installation MSI may leave ACLs unset on custom installation directories allowing a local attacker to introduce executable code to MongoDB's process via DLL hijacking. This issue affects MongoDB Server v6.0 version prior to 6.0.25, MongoDB Server v7.0 version prior to 7.0.21 and MongoDB Server v8.0 version prior to 8.0.5
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| MongoDB | MongoDB Server V6.0 | before 6.0.25 |
| MongoDB | MongoDB Server V7.0 | before 7.0.21 |
| MongoDB | MongoDB Server V8.0 | before 8.0.5 |
Versions were read from the advisory text. No structured product data has been published for this record yet.