CVE-2026-112372: Path Traversal in H3C Magic NX15

This vulnerability in H3C Magic NX15 V100R017 involves improper validation of the fileName argument in the importprofile function of the /api/upload API endpoint. An attacker can exploit this flaw to perform path traversal attacks, potentially accessing unauthorized files on the system. The vulnerability can be triggered remotely without user interaction. Public exploit code is available, increasing the risk of exploitation. The vendor was notified early, but no official fix or patch information is currently available.

Successful exploitation allows remote attackers to traverse directories on the affected system, potentially leading to unauthorized access to sensitive files. The CVSS score of 5.1 indicates a medium impact, with low complexity and no user interaction required. However, the attack requires high privileges (PR:H) and results in limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the /api/upload endpoint and monitor for suspicious activity related to fileName parameter manipulation.