MetaCRM EUVD-2026-33527

No vendor-released patch has been identified at time of analysis - the vendor did not respond to coordinated disclosure, and the CVSS temporal remediation level is undefined (RL:X). As a primary compensating control, restrict access to the upload endpoint (develop/systparam/softlogo/upload.jsp) at the web server or reverse proxy layer using IP allowlists or authentication gateway rules, limiting access to known administrative IP ranges only; this reduces attack surface without affecting non-upload functionality. As a secondary control, configure a Web Application Firewall (WAF) rule to block multipart file uploads to this specific path containing executable extensions (.jsp, .jspx, .war, .class); note this may not catch all bypass techniques such as null-byte injection or double extensions. If the softlogo upload feature is not operationally required, disable or remove the JSP servlet entirely from the deployment - this eliminates the attack surface with no functional trade-off for organizations not using the feature. Monitor web server access logs for POST requests to upload.jsp originating from non-administrative users and alert on any newly created .jsp files in web-accessible directories. Track VulDB advisory https://vuldb.com/vuln/367485 and https://vuldb.com/cve/CVE-2026-10205 for any future vendor patch release.