{"id":"CVE-2026-112372","kind":"vulnerability","aliases":["CVE-2026-112372"],"related":[],"title":"H3C Magic NX15 router: upload path traversal lets remote users write files","description":"A weakness has been identified in H3C Magic NX15 V100R017. This affects the function importprofile of the file /api/upload. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.","summary":"The H3C Magic NX15 V100R017 web upload endpoint /api/upload, in the importprofile function, does not sanitize the fileName argument, so path traversal sequences can write files outside the intended directory. A remote attacker can trigger it and a public exploit is available, which could let them place files on the device.","severity":"medium","cvss":6.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["h3c","infrastructure","magic-nx15","network-appliance"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-19T23:17:36+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T03:47:00+00:00","updated_at":"2026-10-25T03:47:00+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:47:00Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"H3C Magic NX15 router: upload path traversal lets remote users write files","impact":"medium","summary":"The H3C Magic NX15 V100R017 web upload endpoint /api/upload, in the importprofile function, does not sanitize the fileName argument, so path traversal sequences can write files outside the intended directory. A remote attacker can trigger it and a public exploit is available, which could let them place files on the device.","category":"infrastructure","nicknames":[],"who_cares":["h3c","magic-nx15","network-appliance"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker writes arbitrary files outside the upload directory remotely","analyst_note":"Find vendor advisory or firmware fix version and whether /api/upload requires login, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-112372","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Owners of H3C Magic NX15 devices running firmware in the V100R017 line are exposed if the web management interface is reachable. Teams that do not run this appliance can skip it. The sources do not say whether authentication is required or which firmware build is fixed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000572,"input_tokens":3315,"output_tokens":481,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112372':15A,18A '-2026':14A,17A '/api/upload':35B,96C 'affect':89C 'applianc':26B 'argument':45B,101C 'attack':59B,112C,128C 'avail':68B,119C 'caus':103C 'contact':132C 'could':70B,124C 'cve':13A,16A 'devic':77B 'directori':56B 'disclosur':136C 'earli':133C 'endpoint':34B 'exploit':66B,115C 'file':12A,52B,74B,95C 'filenam':44B,102C 'function':39B,91C 'h3c':1A,19B,28B,84C 'identifi':82C 'importprofil':38B,92C 'infrastructur':20B 'initi':110C 'intend':55B 'let':8A,71B 'made':118C 'magic':2A,22B,29B,85C 'magic-nx15':21B 'manipul':98C 'network':25B 'network-appli':24B 'nx15':3A,23B,30B,86C 'outsid':53B 'path':6A,47B,104C 'place':73B 'possibl':108C 'public':65B,122C 'remot':9A,58B,113C 'router':4A 'sanit':42B 'sequenc':49B 'travers':7A,48B,105C 'trigger':61B 'upload':5A,33B 'use':126C 'user':10A 'v100r017':31B,87C 'vendor':130C 'weak':79C 'web':32B 'write':11A,51B","nicknames":[],"mitigations":[],"who_affected":"Owners of H3C Magic NX15 devices running firmware in the V100R017 line are exposed if the web management interface is reachable. Teams that do not run this appliance can skip it. The sources do not say whether authentication is required or which firmware build is fixed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T23:17:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112372","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112372","severity":null,"published_at":"2026-10-19T23:17:36+00:00","modified_at":"2026-10-20T19:27:34+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}