CVE-2026-53907: Stored Cross‑Site Scripting in MCO
MCO is vulnerable to Stored Cross‑Site Scripting (XSS) via the application logo upload functionality. An attacker with the ability to change the application logo can upload a crafted SVG file containing malicious JavaScript code that is executed when the logo is rendered or opened.
Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate Stored XSS via the application logo upload functionality by restricting or disabling acceptance/rendering of user-supplied SVG logos (e.g., block SVG uploads and/or sanitize logo content to remove executable JavaScript before storing or rendering).
- Operational
Review application logo upload history and remove/replace any logos that may have been uploaded as crafted SVGs containing malicious JavaScript, since the XSS is stored and will execute when the logo is rendered or opened.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53907?
CVE-2026-53907 has a medium severity rating of 4.8 according to the CVSS.
How do I fix CVE-2026-53907?
To mitigate CVE-2026-53907, ensure that SVG file uploads are properly sanitized and validated before being processed.
What type of vulnerability is CVE-2026-53907?
CVE-2026-53907 is a Stored Cross-Site Scripting (XSS) vulnerability.
What impact can CVE-2026-53907 have?
CVE-2026-53907 can lead to execution of malicious JavaScript code when the crafted SVG logo is rendered.
Who is affected by CVE-2026-53907?
CVE-2026-53907 affects users of the MCO application who can modify the application logo.