CVE-2026-10205: Metasoft MetaCRM RCE Vulnerability

CVE-2026-10205 Overview

CVE-2026-10205 is an unrestricted file upload vulnerability in Metasoft (美特软件) MetaCRM 6.4.0. The flaw resides in the develop/systparam/softlogo/upload.jsp endpoint, which fails to validate uploaded files. Authenticated remote attackers with low privileges can abuse the endpoint to upload arbitrary content to the server. The issue is tracked under CWE-284: Improper Access Control and has been publicly disclosed. According to the disclosure, the vendor was contacted prior to publication but did not respond.

Critical Impact
Authenticated remote attackers can upload arbitrary files to the MetaCRM server through upload.jsp, with potential for follow-on code execution depending on server configuration.

Affected Products

Metasoft (美特软件) MetaCRM 6.4.0
Component: develop/systparam/softlogo/upload.jsp
Deployment: JSP-based CRM web application

Discovery Timeline

2026-06-01 - CVE-2026-10205 published to NVD
2026-06-01 - Last updated in NVD database
Public disclosure - Details published via VulDB entry #367485 and a Feishu technical write-up

Technical Details for CVE-2026-10205

Vulnerability Analysis

The vulnerability is an unrestricted file upload weakness in the MetaCRM administrative softlogo interface. The handler at develop/systparam/softlogo/upload.jsp accepts uploaded files without enforcing extension allow-listing, MIME-type validation, or content inspection. An authenticated attacker can submit a crafted multipart request and place attacker-controlled files into a server-reachable directory.

The endpoint is intended to update the application's soft logo branding asset. Because the upload routine does not constrain file type or destination, the function can be repurposed to drop executable JSP, scripts, or other web-accessible payloads. The vulnerability is classified under CWE-284 (Improper Access Control), reflecting both inadequate authorization scoping and missing input restrictions on the upload handler.

Root Cause

The root cause is the absence of server-side validation on file uploads in upload.jsp. The handler trusts the client-supplied filename and content type. There is no allow-list of permitted extensions, no rewrite of the stored filename, and no enforcement that uploaded content matches an image format consistent with a logo asset.

Attack Vector

Exploitation requires network access to the MetaCRM web application and a low-privileged authenticated session. An attacker sends a multipart POST request to the softlogo/upload.jsp endpoint with an arbitrary filename and body. If the upload directory is served by the JSP container, the file may be retrievable and, depending on extension handling, executable. The exploit has been disclosed publicly. See the Feishu write-up for proof-of-concept details.

No verified code examples are available. Refer to the linked advisories for request structure and payload details.

Detection Methods for CVE-2026-10205

Indicators of Compromise

POST requests to URI path develop/systparam/softlogo/upload.jsp containing multipart form data with non-image file extensions such as .jsp, .jspx, .war, or .sh.
New or modified files in the MetaCRM softlogo upload directory whose extension does not match expected image formats (.png, .jpg, .gif).
Web access log entries showing GET requests immediately following an upload to a previously nonexistent path under the MetaCRM web root.

Detection Strategies

Inspect web server and application logs for requests targeting softlogo/upload.jsp and correlate with the authenticated user, source IP, and uploaded filename.
Apply file integrity monitoring on the MetaCRM application directories to flag creation of executable web content outside expected asset paths.
Deploy WAF signatures that block multipart uploads to the softlogo endpoint when the filename extension is not on an image allow-list.

Monitoring Recommendations

Forward MetaCRM web access logs and host file events to a centralized SIEM and alert on JSP file creation under web-served paths.
Monitor authenticated session activity for low-privileged accounts performing administrative upload actions outside normal operational windows.
Track outbound network connections from the MetaCRM application server to identify second-stage activity following a successful upload.

How to Mitigate CVE-2026-10205

Immediate Actions Required

Restrict network access to the MetaCRM administrative interface to trusted management networks until a fix is available.
Disable or block external access to develop/systparam/softlogo/upload.jsp at the reverse proxy or WAF layer.
Audit existing files in the softlogo upload directory and remove any non-image content that cannot be attributed to legitimate administrators.
Rotate credentials for low-privileged accounts that have access to the MetaCRM administrative panel.

Patch Information

No vendor patch is currently available. The disclosure record at VulDB CVE-2026-10205 notes that the vendor was contacted prior to publication but did not respond. Operators should monitor Metasoft channels for an official advisory and apply any future updates promptly.

Workarounds

Configure the web server or reverse proxy to deny requests to develop/systparam/softlogo/upload.jsp from untrusted sources.
Strip execute permissions from the softlogo upload directory and configure the JSP container to refuse to compile or serve scripts from that path.
Enforce server-side allow-listing of image extensions and content-type checks via WAF rules until a vendor patch is issued.

bash

# Example nginx reverse proxy rule to block the vulnerable endpoint
location ~* /develop/systparam/softlogo/upload\.jsp$ {
    deny all;
    return 403;
}