CVE-2025-10491CWE-284

MongoDB Windows installation MSI may leave ACLs unset on custom installation directories

High · published September 15, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
1.8
In the wild
Unconfirmed
What it is

The MongoDB Windows installation MSI may leave ACLs unset on custom installation directories allowing a local attacker to introduce executable code to MongoDB's process via DLL hijacking. This issue affects MongoDB Server v6.0 version prior to 6.0.25, MongoDB Server v7.0 version prior to 7.0.21 and MongoDB Server v8.0 version prior to 8.0.5

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00122 · 1.8th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-09-15T16:04Z
EPSS history
Timeline
  • 15 SEP 16:04Z
    MongoDB Windows installation MSI may leave ACLs unset on custom installation directories
    cvelistv5