CVE-2023-54405

CRITICAL 9.8

H3C CVM Unauthenticated File Upload via fileUpload/upload Token

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating the caller-supplied token parameter without restricting path traversal or file type. Attackers can exploit the path traversal in the token parameter to upload a malicious JSP file into a web-accessible directory and then request it to achieve remote code execution as the web-server user. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

CWE	CWE-434
Vendor	h3c
Product	cvm
Published	Oct 2, 2026

Stay Ahead of the Next One

Get instant alerts for h3c cvm

Be the first to know when new critical vulnerabilities affecting h3c cvm are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

H3C / CVM

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/h3c-cvm-arbitrary-file-upload.yaml blog.csdn.net: https://blog.csdn.net/qq_41904294/article/details/134697278 h3c.com: https://www.h3c.com/en/Support/Resource_Center/EN/Cloud_Computing/Catalog/H3C_CAS/H3C_CAS/Technical_Documents/Configure___Deploy/User_Manuals/H3C_CAS_CVM_UG_E0785-21554/?CHID=1087104 vulncheck.com: https://www.vulncheck.com/advisories/h3c-cvm-unauthenticated-file-upload-via-fileupload-upload-token

Credits

🔍 The Shadowserver Foundation