CVE-2026-53907 | MCO is vulnerable to Stored Cross‑Site Scripting (XSS) via t… | CVSS 4.8 MEDIUM

Description

MCO is vulnerable to Stored Cross‑Site Scripting (XSS) via the application logo upload functionality. An attacker with the ability to change the application logo can upload a crafted SVG file containing malicious JavaScript code that is executed when the logo is rendered or opened. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.

Metadata

CVE ID: CVE-2026-53907
State: PUBLISHED
Assigner: CERT-PL
Reserved: 2026-06-11 07:44 UTC
Published: 2026-07-01 11:58 UTC
Last updated: 2026-07-01 13:38 UTC
Primary CWE: CWE-79
CWE-79 Improper Neutralization of Input During Web Page Gene…
Vendor / Product: MyComplianceOffice / MCO
Sources: cve.org · NVD

Severity & Metrics

4.8 MEDIUM CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
MyComplianceOffice	MCO	—	25.3.3.1

Weakness (CWE)

CWE	Source	Description
CWE-79	cna	CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

CVSS scores (1)

Score	Severity	Version	Source	Vector
4.8	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

References (2)