CVE-2026-16324 in MetaCRM
Summary
by MITRE • 07/21/2026
A vulnerability was identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. The impacted element is an unknown function of the file /business/qnaire/upload.jsp. Such manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
This vulnerability resides within Metasoft 美特软件 MetaCRM version 6.4.0 Beta06 and earlier, specifically targeting an unknown function within the /business/qnaire/upload.jsp file. The flaw manifests as an unrestricted file upload vulnerability that allows attackers to bypass normal file validation mechanisms by manipulating the File argument parameter. This represents a critical security weakness that directly violates fundamental web application security principles and aligns with CWE-434 which catalogs insecure file upload vulnerabilities. The vulnerability's remote exploitability means that malicious actors can leverage this flaw from external networks without requiring physical access or prior authentication within the system.
The technical implementation of this vulnerability stems from inadequate input validation and sanitization within the file upload functionality. When users submit files through the qnaire/upload.jsp endpoint, the application fails to properly validate the file type, size, or content before storing the uploaded files on the server. This oversight creates a pathway for attackers to upload malicious files such as web shells, scripts, or other harmful payloads that can be executed within the application's context. The lack of proper file extension checks, MIME type validation, and secure storage mechanisms collectively contribute to this dangerous vulnerability.
The operational impact of this vulnerability extends beyond simple data compromise, potentially enabling full system compromise through remote code execution capabilities. Attackers who successfully exploit this vulnerability can gain persistent access to the affected server, potentially leading to data exfiltration, system infiltration, or use as a foothold for broader network attacks. This aligns with ATT&CK technique T1190 which describes the exploitation of vulnerabilities to establish persistence and execute malicious code on compromised systems. The availability of public exploits for similar unrestricted upload vulnerabilities increases the likelihood of successful exploitation and makes this vulnerability particularly dangerous.
Organizations utilizing affected versions of MetaCRM should immediately implement mitigation strategies including but not limited to restricting file upload functionality, implementing robust input validation, applying proper file type restrictions, and deploying web application firewalls with content inspection capabilities. The lack of vendor response to early disclosure attempts further compounds the risk, indicating potential delays in security patching or support for this specific product line. Security teams should monitor network traffic for suspicious file upload activities and consider implementing additional monitoring controls around the identified vulnerable endpoint to detect potential exploitation attempts.