Is there a public PoC exploit available for CVE-2026-16324?

Yes, a public proof-of-concept exploit is available for CVE-2026-16324. Prioritise patching immediately. EPSS: 0.3%.

MetaCRM CVE-2026-16324

Q: What is the CVSS score of CVE-2026-16324?

CVE-2026-16324 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-46115 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-20 VulDB

GHSA-f93c-9c64-6gg5

File Upload Metacrm

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Network-accessible unauthenticated upload yields high integrity impact (arbitrary file write); C and A rated Low pending confirmation that uploaded files are directly executable.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 20, 2026 - 22:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 20, 2026 - 22:16 vuln.today

CVE Published

Jul 20, 2026 - 21:45 cve.org

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. The impacted element is an unknown function of the file /business/qnaire/upload.jsp. Such manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Unrestricted file upload in Metasoft (美特软件) MetaCRM up to 6.4.0 Beta06 exposes a network-accessible, unauthenticated upload endpoint at /business/qnaire/upload.jsp that accepts arbitrary file types via the File argument, enabling potential web shell deployment on the underlying Java application server. Publicly available exploit code exists (E:P per CVSS 4.0 supplemental metric), and the vendor did not respond to responsible disclosure, leaving no official patch or advisory. No KEV listing exists, but the combination of zero-authentication requirement, public POC, and no vendor patch elevates real-world risk beyond the conservative CVSS 4.0 impact metrics suggest.

Technical ContextAI

CWE-434 (Unrestricted Upload of File with Dangerous Type) describes the root cause: the /business/qnaire/upload.jsp endpoint - part of MetaCRM's questionnaire (qnaire) module - performs no server-side validation of the uploaded file's type, extension, or MIME type. MetaCRM is a Java-based CRM application (indicated by the .jsp extension and CPE cpe:2.3:a:metasoft_美特软件:metacrm:*:*:*:*:*:*:*:*), almost certainly running on a Java servlet container such as Apache Tomcat. In such environments, uploading a .jsp file to a web-accessible directory and then requesting it via HTTP is the classic path to remote code execution via a web shell. The affected version range covers all builds through 6.4.0 Beta06 with no lower bound specified in the CPE wildcard, suggesting all prior versions share the defect.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to the researcher's disclosure. As primary compensating controls, administrators should immediately block external and internal access to the path /business/qnaire/upload.jsp via WAF rules or reverse-proxy ACLs; this prevents exploitation but will disable questionnaire file upload functionality. As a secondary control, configure the web server or servlet container to deny execution of files in the upload storage directory (e.g., via Tomcat security constraints or OS-level ACLs removing execute permissions), which limits the impact of any files already uploaded. Monitor upload directories for unexpected file extensions (particularly .jsp, .jspx, .war). Organizations should urgently evaluate whether this product can be replaced or isolated pending vendor action. VulDB tracking is available at https://vuldb.com/vuln/380685.