Metasoft MetaCRM CVE-2025-7879

No vendor-released patch has been identified at time of analysis, as Metasoft did not respond to early disclosure. Organizations should implement compensating controls: (1) Restrict access to the mobileupload.jsp endpoint to trusted networks only using firewall or WAF rules; (2) Implement file type validation and Content-Type checks at the web server level (e.g., Apache or IIS) to block upload of executable file types (.jsp, .jspx, .war, .exe, .sh); (3) Store uploaded files outside the web root directory where they cannot be directly executed or accessed via HTTP requests; (4) Configure the application server to disable script execution in upload directories via directory-level permissions or web.xml restrictions; (5) Monitor the upload directory for unexpected file additions and review upload logs for suspicious activity. If an upgrade becomes available, apply it immediately after vendor release. Until then, the combination of network segmentation and upload directory hardening provides the strongest mitigation without requiring vendor cooperation.