EUVD-2026-40952
GHSA-qwcf-5293-mm28
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High privilege required to access file export/upload; scope changes because file writes affect the broader server filesystem beyond the application boundary; low C for path disclosure, low I for arbitrary file write.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
2DescriptionCVE.org
MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to data export and upload. Improper validation of the filename parameter allows writing files to arbitrary locations as well as indirect disclosure of absolute server paths through error messages.
Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.
AnalysisAI
Path traversal and path disclosure in MyComplianceOffice MCO's file handling functionality expose authenticated high-privilege users' ability to write files to arbitrary server locations and leak absolute server paths through error messages. Confirmed in version 25.3.3.1 via CERT-PL research, with other versions potentially affected given unsuccessful vendor contact. No public exploit code or active exploitation identified at time of analysis; the high privilege prerequisite (PR:H) substantially constrains real-world attack surface.
Technical ContextAI
CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) underlies both weaknesses reported here. The file handling subsystem associated with data export and upload operations fails to properly sanitize or canonicalize the filename parameter before using it in filesystem operations, allowing directory traversal sequences (e.g., '../../') to escape the intended target directory. A secondary weakness - path disclosure - arises from server error messages that reflect unsanitized input back to the caller, inadvertently revealing absolute filesystem paths. The affected product is identified by CPE cpe:2.3:a:mycomplianceoffice:mco:*:*:*:*:*:*:*:*, indicating MyComplianceOffice's MCO compliance management platform. Because vendor contact was unsuccessful, the exact internal framework or file-handling library responsible has not been publicly confirmed.
RemediationAI
No vendor-released patch has been identified at time of analysis; vendor contact attempts by CERT-PL were unsuccessful. Organizations running MCO should apply the following compensating controls until a patch is available: restrict access to the data export and upload features to the minimum required set of privileged accounts, reducing exposure to the PR:H exploitation path; implement a web application firewall rule to detect and block filename parameters containing path traversal sequences such as '../', '%2e%2e', or absolute path prefixes; enable server-side logging and alerting on file write operations outside expected application directories to detect exploitation attempts; and suppress verbose error messages to external users to eliminate the path disclosure vector. Each control carries trade-offs - WAF rules may block legitimate filenames with dots; suppressing errors may hinder debugging. Consult the vendor advisory page at https://mco.mycomplianceoffice.com/ for patch availability updates.
Privilege escalation in MyComplianceOffice (MCO) compliance platform version 25.3.3.1 lets an authenticated user add the
User enumeration in MyComplianceOffice (MCO) version 25.3.3.1 allows unauthenticated remote attackers to identify valid
Account denial-of-service in MyComplianceOffice MCO 25.3.3.1 enables a remote attacker to permanently lock a targeted us
Unrestricted file upload in MyComplianceOffice MCO version 25.3.3.1 allows an authenticated low-privileged attacker to u
Insecure Direct Object Reference in MyComplianceOffice MCO version 25.3.3.1 allows authenticated users to retrieve tradi
MCO's compliance management platform exposes administrator ACL tree structures to any authenticated low-privileged user
Stored XSS in MyComplianceOffice MCO version 25.3.3.1 allows a privileged attacker with logo-upload rights to plant mali
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today