This vulnerability in Metasoft 美特软件 MetaCRM up to version 6.4.0 Beta06 allows remote attackers to manipulate the 'File' argument in the /common/jsp/upload3.jsp endpoint to perform unrestricted file uploads. This lack of upload restrictions can be leveraged to upload arbitrary files to the server. The vendor has not responded to the disclosure, and no official remediation or patch is currently available. The CVSS 4.0 base score is 6.9, indicating a medium severity level with network attack vector, no privileges required, and no user interaction needed.

Successful exploitation allows an attacker to upload arbitrary files remotely without authentication or user interaction. This could lead to unauthorized file storage on the server, which may be leveraged for further attacks such as remote code execution or data compromise depending on the uploaded file's nature and server configuration. However, no direct exploit in the wild has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is currently available, organizations should consider restricting access to the vulnerable upload endpoint, implementing web application firewall (WAF) rules to detect and block suspicious upload attempts, and monitoring for unusual file uploads as interim mitigations.