CVE•Published 2026-07-01•Modified 2026-07-06•1 article on news•4 live references•NVD data

CVE-2026-53906Mycomplianceoffice · Mycomplianceoffice

Vulnerability data via NVD (ingested)

CVSS v3.1

8.2

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

EPSS percentile

Exploit Prediction Scoring System · top 66% of all CVEs

Weaknesses (CWE)

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CWE-209Generation of Error Message Containing Sensitive Information

Description

MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to data export and upload. Improper validation of the filename parameter allows writing files to arbitrary locations as well as indirect disclosure of absolute server paths through error messages. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.

Timeline

Published 2026-07-01

Modified 2026-07-06

External references

NVD MITRE Exploit-DB VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common). Live host counts are a Premium feature.

Shodan · vuln tag

vuln:CVE-2026-53906

Hosts Shodan has explicitly fingerprinted as vulnerable.

Shodan · product + version

product:"Mycomplianceoffice Mycomplianceoffice" version:"25.3.3.1"

Version-pinned fingerprint from NVD's first vulnerable CPE.

Shodan · banner/body mention

http.html:"Mycomplianceoffice"

HTTP body or banner mentions "Mycomplianceoffice" — catches deploys Shodan didn't identify as a product.

More intel sources (5)

Shodan report

vuln:CVE-2026-53906