CVE-2025-7876 is a medium (CVSS 6.3) unsafe deserialization in Metasoft MetaCRM (MetaCRM up to 6.4.2). The record names no fixed version, so plan on isolating or replacing it. Do not expose the product to untrusted networks until you have confirmed a fix.
What's affected
The record lists MetaCRM up to 6.4.2 as affected. The vulnerable code is in download.jsp (function AnalyzeParam), through the p argument.
No fixed version is named in the record or the write-up.
The write-up says the p parameter reaches an AnalyzeParam routine that passes data to Fastjson deserialization, and that a hardcoded encryption key in an AES helper class weakens the protection around that input. It reports about 1,342 internet search results across 735 unique IP addresses for MetaCRM fingerprints. The write-up claims remote code execution, while the NVD record scores the impact as low, so the two disagree on how bad the outcome is.
The record's CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, a score of 6.3. The record says the vendor was contacted early and did not respond in any way.
The record also says the exploit has been disclosed to the public and may be used. That is not the same as confirmed attacks: this CVE is not in CISA's Known Exploited Vulnerabilities catalog (the record's kev flag is false).
How to check if you're exposed
Find out whether the component is deployed in your estate. These products often arrive inside a larger system, so check your server inventory and your web application directories:
find / -name "download.jsp" -not -path "/proc/*" 2>/dev/null | head
Then check your web server or reverse proxy logs for requests to that path from addresses you do not recognize.
A free in-browser dependency scan at gold.safeguard.sh/scan can show whether this CVE appears in a project's dependency list. Note that it covers packages. Stand-alone applications and firmware are best checked against your own inventory.
What to do now
- Confirm whether you run MetaCRM and which version.
- Remove it from the internet and require VPN access.
- Block requests to download.jsp at the proxy until the vendor responds.
- Rotate any encryption keys or secrets the application uses, since a hardcoded key is public once a write-up describes it.
- Ask the vendor for a fixed build and for confirmation of which versions are affected.
If you maintain a codebase and want to know whether a vulnerable package is actually called, Safeguard's reachability analysis separates packages that are present from code paths that are used.
Why it matters
The weakness class here is CWE-20 (improper input validation), CWE-502 (deserialization of untrusted data). Deserializing data from a request recreates objects chosen by the sender, and libraries that do this have a long record of turning into code execution. Treat any request data that reaches a deserializer as hostile, and never rely on a fixed key shipped in the product to protect it.
MetaCRM has several public findings against it from the same researcher, and the vendor did not respond, per the record. Treat the product as one that needs network isolation, not a series of one off patches.
Quick check
Is there a patch for CVE-2025-7876?
The record does not name a fixed version, and for PAD CMS CERT Polska says none will be published. Treat the product as unpatched, reduce its exposure and check the vendor or project site for news.
Is CVE-2025-7876 being exploited in the wild?
The record's kev flag is false, so it is not in CISA's Known Exploited Vulnerabilities catalog. The record does say the exploit has been disclosed to the public, so assume attackers can find it.
Sources
- Safeguard Gold entry for CVE-2025-7876
- Public write-up on GitHub
- NVD record data for CVE-2025-7876, published 2025-07-20, source cna@vuldb.com
Last reviewed: 18 October 2026.
