MetaCRM CVE-2026-8758

No vendor-released patch has been confirmed as Metasoft did not respond to disclosure. Organizations running MetaCRM 6.4.0 Beta06 or earlier should immediately implement the following compensating controls in priority order: First, block all external network access to /common/jsp/upload3.jsp and /common/jsp/* paths at the web application firewall or reverse proxy level - this prevents remote exploitation but may break legitimate upload functionality for internal users. Second, if upload functionality is required, implement strict authentication and authorization checks before the vulnerable endpoint, limiting access to only trusted authenticated users - this reduces attack surface but does not fix the underlying validation flaw. Third, deploy file upload restrictions at the web server or application server level, allowing only explicitly safe file extensions (PDF, PNG, JPG) and enforcing MIME type validation - note this is bypassable with crafted files and should not be sole protection. Fourth, isolate the MetaCRM application in a segregated network segment with egress filtering to limit post-exploitation impact. Monitor for unusual file uploads or JSP/WAR files appearing in upload directories. Trade-offs: blocking the endpoint may disrupt business workflows dependent on file uploads; authentication requirements may conflict with existing integrations; file type restrictions can be bypassed by sophisticated attackers. Given vendor non-responsiveness, consider migrating to actively maintained CRM alternatives. For detailed exploit indicators, consult the public POC at https://ucn9h68n9289.feishu.cn/wiki/XmoNwpJjJiQrBtkLMitccF56ntb and VulDB CTI at https://vuldb.com/vuln/364385/cti.