EUVD-2026-40953
GHSA-r38x-66p9-p239
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H reflects required logo-upload privilege; S:C because XSS crosses into victim browser scope; C:L/I:L captures limited client-side session and content impact; no availability impact applies.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
2DescriptionCVE.org
MCO is vulnerable to Stored Cross‑Site Scripting (XSS) via the application logo upload functionality. An attacker with the ability to change the application logo can upload a crafted SVG file containing malicious JavaScript code that is executed when the logo is rendered or opened.
Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.
AnalysisAI
Stored XSS in MyComplianceOffice MCO version 25.3.3.1 allows a privileged attacker with logo-upload rights to plant malicious JavaScript inside a crafted SVG file that executes in any user's browser when the application logo is rendered. Reported by CERT-PL, vendor contact was unsuccessful, leaving no official patch or advisory in place. No public exploit code has been identified at time of analysis, though the SVG-based XSS technique is well-documented and trivially replicable against unpatched instances.
Technical ContextAI
MCO (MyComplianceOffice) is a cloud-based compliance, ethics, and regulatory management SaaS platform accessible via mco.mycomplianceoffice.com. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored Cross-Site Scripting): the application fails to sanitize SVG content uploaded as the application logo before serving or rendering it. SVG files are XML-based and can embed executable JavaScript via inline event handlers (e.g., onload, onerror attributes) or explicit script tags; when served without sanitization or a restrictive Content Security Policy, these scripts execute in the victim's browser context. The CPE string cpe:2.3:a:mycomplianceoffice:mco:*:*:*:*:*:*:*:* carries a wildcard version field, reflecting that CERT-PL could only confirm version 25.3.3.1 due to the absence of vendor cooperation, leaving the broader affected version surface unresolved.
RemediationAI
No vendor-released patch has been identified at time of analysis - CERT-PL's vendor contact attempts were unsuccessful and no fix version has been disclosed. As the primary compensating control, administrators should immediately audit and restrict which accounts hold logo-upload privileges, removing that right from any account that does not operationally require it; this directly reduces the attacker population. At the application or WAF layer, block SVG file uploads for the logo upload endpoint and permit only rasterized formats (PNG, JPG, GIF), which eliminates the scriptable vector entirely at the cost of scalable vector logo support - an acceptable trade-off. Additionally, enforcing a strict Content-Security-Policy header (e.g., script-src 'self') across MCO pages will reduce the impact of any XSS that does execute by preventing inline script evaluation. Monitor https://cert.pl/en/posts/2026/07/CVE-2026-53902 for patch availability updates and check the vendor portal at https://mco.mycomplianceoffice.com/ for any security bulletins.
Privilege escalation in MyComplianceOffice (MCO) compliance platform version 25.3.3.1 lets an authenticated user add the
User enumeration in MyComplianceOffice (MCO) version 25.3.3.1 allows unauthenticated remote attackers to identify valid
Account denial-of-service in MyComplianceOffice MCO 25.3.3.1 enables a remote attacker to permanently lock a targeted us
Unrestricted file upload in MyComplianceOffice MCO version 25.3.3.1 allows an authenticated low-privileged attacker to u
Insecure Direct Object Reference in MyComplianceOffice MCO version 25.3.3.1 allows authenticated users to retrieve tradi
MCO's compliance management platform exposes administrator ACL tree structures to any authenticated low-privileged user
Path traversal and path disclosure in MyComplianceOffice MCO's file handling functionality expose authenticated high-pri
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today