CVE-2026-53906

highCVSS 8.2covered by 1 sourcefirst seen 2026-07-01

MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to data export and upload. Improper validation of the filename parameter allows writing files to arbitrary locations as well as indirect disclosure of absolute server paths through error messages. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.

⚡ Watch CVE-2026-53906

Get an email if CVE-2026-53906 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all EPSS-scored CVEs.

Advisory coverage (1)

highCVE-2026-53906: MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related…nvd · 2026-07-01

External references

NVD record for CVE-2026-53906

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-53906 status](https://www.csirts.com/badge/CVE-2026-53906)](https://www.csirts.com/cve/CVE-2026-53906)