This vulnerability affects Metasoft 美特软件 MetaCRM versions up to 6.4.0 Beta06. It arises from insufficient validation of the 'File' argument in the /common/jsp/upload3.jsp component, enabling an attacker to perform unrestricted file uploads remotely. The vulnerability is remotely exploitable without authentication or user interaction. The CVSS 4.0 base score is 6.9, reflecting medium severity with network attack vector, low complexity, and no privileges required. The vendor was contacted but did not respond, and no official patch or remediation guidance is currently available.

Successful exploitation could allow an attacker to upload arbitrary files to the server, potentially leading to unauthorized file storage or execution depending on the server configuration. This could facilitate further attacks such as remote code execution or data compromise. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or vendor response is available, users should consider implementing temporary mitigations such as restricting file upload types, validating file inputs, or isolating the upload functionality until a patch is released. Monitor official vendor channels for updates.