The flaw in MCO arises from insufficient validation of the filename parameter used during data export and upload processes. The application accepts a crafted filename that bypasses directory resolution logic, allowing a file to be written to an arbitrary location on the server. In addition, the application reveals absolute server paths in error messages, satisfying an information‑exposure weakness. Together, these lead to path traversal (CWE‑22) coupled with an information leakage (CWE‑209), enabling an attacker to create or modify protected files and to learn sensitive environment details.

MyComplianceOffice MCO is confirmed to be vulnerable in version 25.3.3.1. No vendor patch or official fix has been released, and vendor contact attempts were unsuccessful. The flaw may also exist in other, as yet unspecified, releases of the product.

The CVSS score of 5.1 indicates moderate severity. The EPSS rating of less than 1 % suggests exploitation is unlikely but not impossible. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through the file export or upload endpoints that accept a filename parameter; an attacker could supply a to write the file to an arbitrary location while the resulting error message exposes the absolute server path.