MyComplianceOffice MCO EUVD-2026-40952

Exploitation requires authenticated access with high privileges (PR:H per CVSS 4.0 vector) specifically to the data export and upload functionality within MCO. The filename parameter within these features must be controllable by the attacker - no special non-default configuration is needed beyond having access to these built-in features. The path disclosure component requires only that the attacker can trigger error conditions via the same filename parameter. Limiting factors: exploitation is constrained to users who already hold high-privilege roles within the MCO application, ruling out unauthenticated remote attackers and low-privilege account holders. Network access to the MCO instance is required (AV:N). No user interaction from a third party is needed once the attacker is authenticated.

The CVSS 4.0 base score of 5.1 reflects a medium-severity finding with a network attack vector (AV:N) but a high privilege requirement (PR:H), which is the dominant risk-limiting factor. The impact metrics in the provided vector assign no direct impact on the vulnerable system (VC:N/VI:N/VA:N) and low subsequent-system impact (SC:L/SI:L), meaning the scoring authority judged that the web application layer itself is unharmed and the risk surfaces in the broader server environment through unauthorized file writes. No EPSS score was provided in source data; no CISA KEV listing exists; and no public proof-of-concept has been identified. The real-world risk is therefore moderate-to-low: exploitation requires a threat actor to already hold high-privilege credentials within MCO, significantly reducing the attack surface to insider threat, compromised admin accounts, or scenarios where privilege escalation preceded this step. The path disclosure sub-component adds reconnaissance value for chained attacks but does not itself enable direct system compromise. A key uncertainty is the version scope - CERT-PL confirmed only 25.3.3.1, and the full affected range is unknown due to vendor non-response.

An attacker with high-privilege access to MCO - such as a malicious insider or an actor who has separately compromised an administrator credential - navigates to the data export or upload functionality and submits a crafted filename parameter containing directory traversal sequences. The server writes the submitted file to an arbitrary location on the filesystem (e.g., a web-accessible directory or a configuration path), potentially enabling secondary impacts such as configuration tampering or web shell placement. Additionally, triggering validation errors with crafted inputs causes the server to return absolute filesystem paths in error responses, aiding reconnaissance for further exploitation.