This vulnerability in Metasoft 美特软件 MetaCRM allows an attacker to perform unrestricted file uploads by manipulating the File argument in an unknown function within /business/qnaire/upload.jsp. The vulnerability affects versions up to 6.4.0 Beta06. Exploitation requires no privileges or user interaction and can be performed remotely. The CVSS 4.0 base score is 6.9, indicating a medium severity level. The vendor has not provided any response or patch, and no official remediation guidance is available.

Successful exploitation could allow an attacker to upload arbitrary files to the server, potentially leading to further compromise depending on the server configuration and file handling. The vulnerability is remotely exploitable without authentication, increasing the risk of unauthorized access or code execution. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider implementing temporary mitigations such as restricting access to the upload functionality, validating and sanitizing uploaded files, and monitoring for suspicious upload activity until an official fix is released.