Arbitrary file upload in Metasoft Metacrm
CVE-2025-7877
A vulnerability, which was classified as critical, has been found in Metasoft 美特软件 MetaCRM up to 6.4.2. This issue affects some unknown processing of the file sendfile.jsp. The manipulation of the argument File leads to unrestricted upload…
EPSS: 0.003 (55.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Metasoft Metacrm
- Metasoft 美特软件 Metacrm — versions 6.4.0, 6.4.1, 6.4.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- VDB-316991 | Metasoft 美特软件 MetaCRM sendfile.jsp unrestricted upload (technical-description, Third Party Advisory, VDB Entry, vdb-entry)
- VDB-316991 | CTI Indicators (IOB, IOC, TTP, IOA) (signature, Permissions Required, permissions-required, VDB Entry)
- Submit #611252 | Beijing Metasoft Technology Co., Ltd. (China) MetaCRM 6.4.2 Unrestricted Upload (Third Party Advisory, VDB Entry, third-party-advisory)
- cna@vuldb.com (Exploit, Third Party Advisory, exploit)
Frequently asked questions
- What is CVE-2025-7877?
- CVE-2025-7877 is a medium-severity vulnerability in Metasoft Metacrm, classified under Improper Access Control. CVSS score: 6.3/10. Published 2025-07-20.
- How severe is CVE-2025-7877?
- Medium severity. CVSS v3 base score is 6.3 out of 10.
- Is CVE-2025-7877 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.