CVE-2026-16324: Metasoft MetaCRM RCE Vulnerability

CVE-2026-16324 Overview

CVE-2026-16324 is an unrestricted file upload vulnerability in Metasoft (美特软件) MetaCRM up to version 6.4.0 Beta06. The flaw resides in an unknown function within /business/qnaire/upload.jsp, where manipulation of the File argument allows attackers to upload arbitrary files without validation. The issue is classified under [CWE-284] Improper Access Control. Attackers can exploit the flaw remotely without authentication or user interaction. The vendor was contacted before public disclosure but did not respond. A public exploit is available, increasing the likelihood of opportunistic abuse against exposed MetaCRM deployments.

Critical Impact
Remote unauthenticated attackers can upload arbitrary files to MetaCRM servers, potentially enabling webshell deployment and follow-on compromise of business data.

Affected Products

Metasoft (美特软件) MetaCRM versions up to 6.4.0 Beta06
The vulnerable component is /business/qnaire/upload.jsp
No vendor-supplied fixed version has been published

Discovery Timeline

2026-07-20 - CVE-2026-16324 published to the National Vulnerability Database (NVD)
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-16324

Vulnerability Analysis

The vulnerability affects the questionnaire upload handler at /business/qnaire/upload.jsp in MetaCRM. The endpoint accepts a File parameter and processes uploaded content without enforcing restrictions on file type, extension, or content. An attacker can submit a crafted HTTP request containing an executable server-side payload such as a JSP webshell. Once written to a location served by the application container, the file may be requested directly to execute attacker-controlled code within the MetaCRM process context. Because the endpoint requires no authentication and is reachable over the network, exploitation is straightforward and can be automated at scale.

Root Cause

The root cause is improper access control combined with missing upload validation [CWE-284]. The upload.jsp handler does not verify caller identity, enforce an allowlist of permitted file extensions, or sanitize the destination path. This design permits arbitrary file writes into the web application directory tree.

Attack Vector

Exploitation occurs over the network via a single HTTP POST request to the vulnerable JSP endpoint. The attacker supplies a malicious file in the File parameter and, upon successful upload, requests the resulting URL to trigger execution. No credentials, session tokens, or user interaction are required, and the exploit is publicly available according to the VulDB entry for CVE-2026-16324.

See the Feishu technical write-up for a detailed proof-of-concept description.

Detection Methods for CVE-2026-16324

Indicators of Compromise

HTTP POST requests to /business/qnaire/upload.jsp originating from unexpected external sources
New .jsp, .jspx, or .war files appearing under MetaCRM web directories after upload activity
Outbound network connections initiated by the MetaCRM application process to unfamiliar hosts
Unusual child processes spawned by the Java application server hosting MetaCRM

Detection Strategies

Inspect web server access logs for POST requests targeting upload.jsp paths under /business/qnaire/ and correlate with subsequent GET requests to newly created files
Deploy Web Application Firewall (WAF) rules that flag or block multipart uploads containing server-side scripting extensions to this endpoint
Monitor file integrity on MetaCRM installation directories and alert on creation of executable content outside expected deployment workflows

Monitoring Recommendations

Baseline normal upload behavior for the questionnaire module and alert on deviations in request volume, source geography, or user agent
Forward application, web server, and endpoint telemetry to a centralized SIEM for correlation across upload, file creation, and process execution events
Alert on JSP files being written by the application user account to paths that also serve HTTP responses

How to Mitigate CVE-2026-16324

Immediate Actions Required

Restrict network access to MetaCRM administrative and upload endpoints using firewall rules or reverse proxy access lists until a vendor patch is available
Block direct external access to /business/qnaire/upload.jsp at the perimeter or with a WAF rule
Audit MetaCRM web directories for unauthorized .jsp files and remove any that cannot be attributed to legitimate deployment activity
Rotate credentials and API keys accessible to the MetaCRM host if compromise is suspected

Patch Information

No vendor patch or updated release has been published at the time of writing. According to the NVD entry, the vendor was contacted prior to disclosure but did not respond. Track the VulDB advisory for CVE-2026-16324 for updates on fixed versions.

Workarounds

Remove or rename upload.jsp under /business/qnaire/ if the questionnaire upload feature is not required in your deployment
Enforce authentication and role-based access control at the reverse proxy layer for all upload endpoints
Configure the application server to disallow execution of JSP files from user-writable directories
Deploy a WAF rule that inspects multipart form data and rejects uploads whose filename extensions match server-executable types

bash

# Example nginx configuration to block external access to the vulnerable endpoint
location ~* /business/qnaire/upload\.jsp$ {
    deny all;
    return 403;
}