CVE-2026-53906 describes a path traversal vulnerability in MyComplianceOffice MCO related to file handling during data export and upload. Improper validation of the filename parameter enables attackers with high privileges to write files to arbitrary locations on the server and causes indirect disclosure of absolute server paths through error messages. The vulnerability is confirmed in version 25.3.3.1. Attempts to contact the vendor for remediation information were unsuccessful, and no patch or official fix has been published. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and privileges required, with low scope impact and limited confidentiality and integrity impact.

An attacker with high privileges can exploit this vulnerability to write files to arbitrary locations on the server, potentially leading to unauthorized file manipulation. Additionally, the vulnerability allows indirect disclosure of absolute server paths, which may aid further attacks. The overall impact is rated medium with a CVSS score of 5.1. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since vendor contact attempts were unsuccessful and no official fix is available, organizations should monitor for vendor updates. Until a patch is released, restrict access to the affected functionality to trusted users only and consider additional controls to limit file handling operations if possible.