{"id":"CVE-2026-112372","title":"H3C Magic NX15 upload importprofile path traversal","summary":"A weakness has been identified in H3C Magic NX15 V100R017. This affects the function importprofile of the file /api/upload. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely.…","severity":"medium","cvss":6.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R","cvssSource":"cna","cwe":["CWE-22"],"vendor":"H3C","product":"Magic NX15","affected":["magic_nx15 V100R017"],"published":"2026-10-19","updated":"2026-10-19","sourceUpdated":"2026-10-19T22:45:19.358Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112372","references":[{"url":"https://vuldb.com/vuln/422420","label":"VDB-422420 | H3C Magic NX15 upload importprofile path traversal"},{"url":"https://vuldb.com/vuln/422420/cti","label":"VDB-422420 | CTI Indicators (IOB, IOC, TTP, IOA)"},{"url":"https://vuldb.com/cve/CVE-2026-112372","label":"CVE-2026-112372 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/983539","label":"Submit #983539 | H3C Magic NX15 NX15V100R017 Path Traversal"},{"url":"https://github.com/XxingGoD/H3C-NX15-R017-Vulns/tree/main/H3C/NX15R017/importprofile_arbitrary_file_write"}],"tags":["cve.org"],"ingestedAt":"2026-10-19T23:47:31.359Z","slug":"CVE-2026-112372","body":"## Overview\n\nA weakness has been identified in H3C Magic NX15 V100R017. This affects the function importprofile of the file /api/upload. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.\n\n## Affected\n\n- `magic_nx15 V100R017`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":36.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}