Executive brief
MyComplianceOffice (MCO) is a compliance management platform used by financial services and investment firms to automate regulatory oversight. A security flaw in the file upload system allows users to bypass safety checks and upload unauthorized file types to the server. This could potentially allow a low-privileged user to interfere with system integrity or upload malicious content.
Technical details
The vulnerability is classified as Unrestricted Upload of File with Dangerous Type (CWE-434). The root cause is that the MCO application performs file type validation only on the client side (e.g., via JavaScript or HTML attributes), which can be easily intercepted and bypassed using a proxy or custom request. An authenticated attacker with low privileges can exploit this to upload files with arbitrary extensions or MIME types to the server. While the impact on confidentiality and availability is rated as none by the reporter, it poses a risk to system integrity. The vulnerability was confirmed in version 25.3.3.1, and no patch has been confirmed due to unsuccessful vendor contact.
Affected products
- MyComplianceOffice MCO 25.3.3.1
Timeline
- 2026-07-01: disclosed: Vulnerability disclosed by CERT Polska
- 2026-07-01: advisory: CVE-2026-53909 published