---
id: CVE-2026-112372
title: H3C Magic NX15 upload importprofile path traversal
summary: >-
  A weakness has been identified in H3C Magic NX15 V100R017. This affects the
  function importprofile of the file /api/upload. This manipulation of the
  argument fileName causes path traversal. It is possible to initiate the attack
  remotely.…
severity: medium
cvss: 6.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R'
cvssSource: cna
cwe:
  - CWE-22
vendor: H3C
product: Magic NX15
affected:
  - magic_nx15 V100R017
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T22:45:19.358Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112372'
references:
  - url: 'https://vuldb.com/vuln/422420'
    label: VDB-422420 | H3C Magic NX15 upload importprofile path traversal
  - url: 'https://vuldb.com/vuln/422420/cti'
    label: 'VDB-422420 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-112372'
    label: CVE-2026-112372 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/983539'
    label: 'Submit #983539 | H3C Magic NX15 NX15V100R017 Path Traversal'
  - url: >-
      https://github.com/XxingGoD/H3C-NX15-R017-Vulns/tree/main/H3C/NX15R017/importprofile_arbitrary_file_write
tags:
  - cve.org
ingestedAt: '2026-10-19T23:47:31.359Z'
---

## Overview

A weakness has been identified in H3C Magic NX15 V100R017. This affects the function importprofile of the file /api/upload. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

## Affected

- `magic_nx15 V100R017`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.