CVE-2026-112372
H3C Magic NX15 upload importprofile path traversal
- State
- Published
- Severity
- 5.1 Medium
- Published
- Oct 19, 2026
- Updated
- Oct 20, 2026
- Reserved
- Oct 19, 2026
Description
A weakness has been identified in H3C Magic NX15 V100R017. This affects the function importprofile of the file /api/upload. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P | VulDB |
| 3.1 | 6.6 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.6 Medium | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 5.8 Medium | AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-22 Path Traversal
Affected Products
| Product | Versions |
|---|---|
Magic NX15H3C |
|
References
- VDB-422420 | H3C Magic NX15 upload importprofile path traversalvdb-entrytechnical-description
- VDB-422420 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-112372 | CVE Analysis and Reportthird-party-advisory
- Submit #983539 | H3C Magic NX15 NX15V100R017 Path Traversalthird-party-advisory
- https://github.com/XxingGoD/H3C-NX15-R017-Vulns/tree/main/H3C/NX15R017/importprofile_arbitrary_file_writeexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.