This vulnerability in MetaCRM 6.4.0 arises from an unrestricted upload function in the upload.jsp file located at develop/systparam/softlogo/. It permits remote attackers to upload files without adequate validation or restrictions, potentially leading to unauthorized file uploads. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. The vendor was notified but has not provided any response or patch. No cloud service is involved, and no official remediation or temporary fixes are documented.

The vulnerability allows remote attackers to upload files without restriction, which could lead to unauthorized file placement on the affected system. The exact impact depends on the nature of the uploaded files and the server configuration but may include unauthorized code execution or data compromise. There are no confirmed exploitations in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, organizations should consider implementing manual controls such as restricting access to the upload.jsp endpoint, applying web application firewall (WAF) rules to block suspicious upload attempts, or disabling the upload functionality if not required. Monitor for any updates from the vendor regarding patches or official mitigations.