Description
MCO is vulnerable to Stored Cross‑Site Scripting (XSS) via the application logo upload functionality. An attacker with the ability to change the application logo can upload a crafted SVG file containing malicious JavaScript code that is executed when the logo is rendered or opened.

Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.
Published: 2026-07-01
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability allows any user who can change the application logo to upload a crafted SVG file containing embedded JavaScript. When the logo is viewed or opened, the embedded script executes in the victim’s browser context, providing client‑side code execution. The attacker does not gain server‑side privileges and is limited to the scope of the compromised user session.

Affected Systems

MyComplianceOffice MCO. The defect has been confirmed only in version 25.3.3.1; other versions may also be affected, but this has not yet been verified. Vendor outreach attempts were unsuccessful and no public fix has been released.

Risk and Exploitability

The CVSS score of 4.8 indicates a moderate severity. The EPSS score of < 1% signifies a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an account with permission to upload or modify the application logo, typically administrators or users with configuration privileges. The impact is limited to client‑side JavaScript execution and does not provide any server‑side access.

Generated by OpenCVE AI on July 17, 2026 at 13:13 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Restrict the logo‑upload functionality so that only administrators or users with configuration privileges can upload or change the logo.
  • Implement server‑side validation that removes or rejects <script> elements and other executable content from SVG files before they are stored or rendered.
  • Block SVG uploads entirely in the logo upload interface until a vendor‑issued patch is available.
  • Monitor upload logs for anomalous SVG uploads activity.
  • Consult the vendor’s website or security advisories regularly for patches or updates that address this vulnerability.

Generated by OpenCVE AI on July 17, 2026 at 13:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Mycomplianceoffice
Mycomplianceoffice mco
Vendors & Products Mycomplianceoffice
Mycomplianceoffice mco

Wed, 01 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
Description MCO is vulnerable to Stored Cross‑Site Scripting (XSS) via the application logo upload functionality. An attacker with the ability to change the application logo can upload a crafted SVG file containing malicious JavaScript code that is executed when the logo is rendered or opened. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.
Title Stored Cross‑Site Scripting in MCO
Weaknesses CWE-79
References
Metrics cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Mycomplianceoffice Mco
cve-icon MITRE

Status: PUBLISHED

Assigner: CERT-PL

Published:

Updated: 2026-07-01T13:38:34.349Z

Reserved: 2026-06-11T07:44:52.179Z

Link: CVE-2026-53907

cve-icon Vulnrichment

Updated: 2026-07-01T13:38:29.972Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-17T13:15:16Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')