EUVD-2026-40955
GHSA-5v97-p7p8-r448
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low-privileged network access required; scope changed to reflect downstream integrity impact from arbitrary file placement; no confidentiality or availability impact confirmed.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
2DescriptionCVE.org
MCO does not correctly validate types of uploaded files. File upload validation functionality relies only on client-side checks, which can be bypassed. An authorized, low-privileged attacker can upload files with arbitrary types to the server.
Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.
AnalysisAI
Unrestricted file upload in MyComplianceOffice MCO version 25.3.3.1 allows an authenticated low-privileged attacker to upload files of arbitrary types by bypassing client-side-only validation controls. The CVSS 4.0 vector confirms network-accessible exploitation with low complexity, requiring only a valid low-privileged account and a web proxy to intercept and modify upload requests. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type), a class of vulnerability arising when applications delegate file type enforcement exclusively to browser-side JavaScript rather than performing authoritative validation on the server. In MCO (CPE: cpe:2.3:a:mycomplianceoffice:mco:*:*:*:*:*:*:*:*), a compliance management platform by MyComplianceOffice, the upload mechanism checks file types only in the client, meaning any standard proxy tool (e.g., Burp Suite, OWASP ZAP) can intercept the POST request and substitute a different file before it reaches the server. Server-side controls such as MIME type inspection, extension allowlisting, and file magic-byte validation are absent or insufficient. The CVSS 4.0 vector's subsequent-system integrity impact (SI:L) indicates the uploaded file can affect systems or processes beyond the immediate upload handler.
RemediationAI
No vendor-released patch has been identified at time of analysis due to unsuccessful vendor contact attempts documented by CERT-PL. Organizations should monitor https://mco.mycomplianceoffice.com/ and https://cert.pl/en/posts/2026/07/CVE-2026-53902 for any vendor-issued fix or updated advisory. As compensating controls, administrators should implement server-side file type validation that inspects MIME type headers, enforces an extension allowlist, and verifies file magic bytes before accepting any upload - note that relying on the Content-Type header alone is insufficient, as this is also attacker-controlled. Uploaded files should be stored outside web-accessible directories and served only through a controller that enforces content-type on delivery, preventing direct execution. Restricting file upload access to only the minimum set of users with a demonstrated business need reduces the attacker pool given the PR:L prerequisite. Auditing server logs for unexpected file extensions in upload endpoints can help detect exploitation attempts in the interim.
Privilege escalation in MyComplianceOffice (MCO) compliance platform version 25.3.3.1 lets an authenticated user add the
User enumeration in MyComplianceOffice (MCO) version 25.3.3.1 allows unauthenticated remote attackers to identify valid
Account denial-of-service in MyComplianceOffice MCO 25.3.3.1 enables a remote attacker to permanently lock a targeted us
Insecure Direct Object Reference in MyComplianceOffice MCO version 25.3.3.1 allows authenticated users to retrieve tradi
MCO's compliance management platform exposes administrator ACL tree structures to any authenticated low-privileged user
Path traversal and path disclosure in MyComplianceOffice MCO's file handling functionality expose authenticated high-pri
Stored XSS in MyComplianceOffice MCO version 25.3.3.1 allows a privileged attacker with logo-upload rights to plant mali
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today