SB2026090807 - MongoDB Enterprise Advanced with IBM update for basic-ftp

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026090807

SB2026090807 - MongoDB Enterprise Advanced with IBM update for basic-ftp

Published: September 8, 2026

Security Bulletin ID SB2026090807
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) CRLF injection (CVE-ID: CVE-2026-39983)

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to inject arbitrary FTP commands.

The vulnerability exists due to improper neutralization of CRLF sequences in high-level path APIs in dist/Client.js and FtpContext.send() when processing attacker-controlled file path parameters. A remote attacker can supply a specially crafted path containing CRLF sequences to inject arbitrary FTP commands.

The issue affects methods such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir().


Remediation

Install update from vendor's website.

References