Metasoft MetaCRM CVE-2025-7877

No vendor-released patch is available at this time; Metasoft has not responded to disclosure attempts. Immediate compensating controls are required: (1) Disable or restrict access to sendfile.jsp at the web server level using firewall rules or application configuration, limiting access only to trusted internal networks if the feature is required for business operations. (2) Implement strict file upload validation at the application level: restrict uploaded file extensions to a whitelist (e.g., allow only .pdf, .doc, .txt), enforce file type verification using magic bytes or MIME type detection, and store uploads outside the web root directory to prevent execution. (3) Enforce the principle of least privilege: audit MetaCRM user accounts and remove upload permissions from users who do not require this functionality. (4) Monitor the sendfile.jsp endpoint for suspicious activity: log all file upload attempts, alert on unexpected file types or sizes, and review logs regularly for signs of exploitation. (5) Consider network segmentation: isolate MetaCRM systems from sensitive data stores and limit outbound connections to prevent data exfiltration if a file upload is successfully exploited. Organizations should contact Metasoft directly to request a security patch or consider migration to alternative CRM solutions if no vendor fix is provided within a reasonable timeframe. References: https://vuldb.com/?id.316991, https://github.com/FightingLzn9/vul/blob/main/MetaCRM6-Upload-4.md