The vulnerability stems from MyComplianceOffice MCO’s file upload feature, which relies solely on client-side checks to enforce allowed file types. An authenticated user with low privileges can bypass these controls, causing the server to store any file type, including potential malware. This flaw, identified as CWE-434 (Unrestricted Upload of File with Dangerous Type), does not by itself trigger execution of files, but storing malicious content can expose unauthorized data or create a vector for future attacks if the files are later accessed or executed by other users or processes.

The flaw has been confirmed in MyComplianceOffice MCO version 25.3.3.1. Because the vendor has not released a fix and contact attempts were unsuccessful, earlier or later releases that employ the same upload mechanism may also be affected.

The CVSS score of 5.3 marks the vulnerability as moderate, and the EPSS of <1 % suggests a low likelihood of exploitation in the near term. The vulnerability is not listed in CISA KEV, indicating no widely documented exploitation. Attackers would need an authenticated session, typically over the public web interface, and rely on client-side validation bypass to upload arbitrary files. The principal risk is the unauthorized placement of potentially malicious files, which could lead to data leakage or create conditions for later exploitation if the files are accessed or executed by privileged users or processes.