CVE-2024-7553
Accessing Untrusted Directory May Allow Local Privilege Escalation
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1.
Required Configuration:
Only environments with Windows as the underlying operating system is affected by this issue
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Accessing Untrusted Directory May Allow Local Privilege Escalation
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1.
Required Configuration:
Only environments with Windows as the underlying operating system is affected by this issue
- Record
CVE-2024-7553- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2024-48459
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1.
Required Configuration:
Only environments with Windows as the underlying operating system is affected by this issue
- Record
EUVD-2024-48459- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5m47-pw5x-gvrc
Incorrect validation of files loaded from a local untrusted directory may allow local privilege...
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1.
Required Configuration:
Only environments with Windows as the underlying operating system is affected by this issue
- Record
GHSA-5m47-pw5x-gvrc- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
NVD
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1.
Required Configuration:
Only environments with Windows as the underlying operating system is affected by this issue
- Record
CVE-2024-7553- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
Accessing Untrusted Directory May Allow Local Privilege Escalation
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1.
Required Configuration:
Only environments with Windows as the underlying operating system is affected by this issue
- Record
CVE-2024-7553- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVJLSEC-2026-180
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1.
Required Configuration:
Only environments with Windows as the underlying operating system is affected by this issue
- Record
JLSEC-2026-180- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-7553
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1. Required Configuration: Only environments with Windows as the underlying operating system is affected by this issue
- Record
UBUNTU-CVE-2024-7553- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBIT-mongodb-2024-7553 No score
Accessing Untrusted Directory May Allow Local Privilege Escalation
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1.
Required Configuration:
Only environments with Windows as the underlying operating system is affected by this issue
- Record
BIT-mongodb-2024-7553- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mongodbBitnami |
5.0.0 up to 5.0.27, 6.0.0 up to 6.0.16, 7.0.0 up to 7.0.12 | 5.0.276.0.167.0.12 |
MongoC_jllJulia |
before 1.28.1+0 | 1.28.1+0 |
mongodbUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1:2.4.6-0ubuntu51:2.4.6-0ubuntu61:2.4.8-1ubuntu11:2.4.8-21:2.4.9-11:2.4.9-1ubuntu11:2.4.9-1ubuntu21:2.4.9-1ubuntu2+esm2 |
None known |
mongodbUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1:2.6.10-0ubuntu11:2.6.10-0ubuntu1+esm2 |
None known |
php-mongodbUbuntu:16.04:LTS |
All versions, plus listed versions 1.1.2-2~ubuntu11.1.5-1~build1 |
None known |
mongodbUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1:3.4.7-11:3.4.7-1ubuntu11:3.4.7-1ubuntu21:3.4.7-1ubuntu41:3.4.14-3ubuntu1 Show 7 moreShow less1:3.4.14-3ubuntu21:3.6.3-0ubuntu11:3.6.3-0ubuntu1.11:3.6.3-0ubuntu1.31:3.6.3-0ubuntu1.41:3.6.3-0ubuntu1.4+esm11:3.6.3-0ubuntu1.4+esm2 |
None known |
php-mongodbUbuntu:18.04:LTS |
All versions, plus listed versions 1.2.3-1build11.3.4-1build1 |
None known |
mongo-c-driverUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.15.0-11.15.1-11.15.2-11.16.0-11.16.1-11.16.1-1build11.16.1-1build21.16.1-1ubuntu0.1~esm1 |
None known |
mongodbUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu21:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu51:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.21:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.31:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1 |
None known |
php-mongodbUbuntu:20.04:LTS |
All versions, plus listed versions 1.5.5-1build11.6.1-41.6.1-4build1 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mongo-c-driverUbuntu:22.04:LTS |
All versions, plus listed versions 1.18.0-11.19.1-11.19.2-11.20.0-11.20.0-1build11.20.1-11.21.0-11.21.0-1build1 |
None known |
php-mongodbUbuntu:22.04:LTS |
All versions, plus listed versions 1.9.0+1.7.5-2build21.11.1+1.9.2+1.7.5-41.12.0+1.9.2+1.7.5-31.12.0+1.9.2+1.7.5-4 |
None known |
mongo-c-driverUbuntu:24.04:LTS |
All versions, plus listed versions 1.24.3-11.24.4-11.25.1-11.25.2-11.25.4-11.26.0-11.26.0-1.1ubuntu11.26.0-1.1ubuntu2 |
None known |
php-mongodbUbuntu:24.04:LTS |
All versions, plus listed versions 1.15.0+1.11.1+1.9.2+1.7.5-1build11.15.0+1.11.1+1.9.2+1.7.5-1ubuntu11.15.0+1.11.1+1.9.2+1.7.5-1ubuntu21.15.0+1.11.1+1.9.2+1.7.5-1ubuntu3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-7553 is a high vulnerability (CVSS 7.3) in Mongodb C Driver, published August 7, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in mongodb 5.0.27.
References
jira.mongodb.org/browse/PHPC-2369
nvd.nist.gov/vuln/detail/CVE-2024-7553
github.com/advisories/GHSA-5m47-pw5x-gvrc
ubuntu.com/security/CVE-2024-7553
cve.org/CVERecord?id=CVE-2024-7553