The vulnerability permits an unauthenticated attacker to upload an arbitrary file to the H3C CVM component via its /cas/fileUpload/upload API. The upload token accepts a path traversal payload that is not validated, allowing the attacker to place a malicious JSP file into a web‑accessible directory. Once the file is uploaded, the attacker can invoke it through a web request, thereby executing code with the privileges of the web‑server user. This fulfills the criteria for remote code execution, which compromises confidentiality, integrity, and availability of the affected system.

The flaw affects the Cloud Virtualization Management component of the H3C CAS cloud platform, identified by the vendor H3C and the product CVM. No specific version numbers were supplied, so any deployment of H3C CVM is potentially impacted until a patch is applied.

With a CVSS score of 9.3 the vulnerability is classified as critical, reflecting the ease of exploitation and the severe impact of RCE. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, but the lack of authentication and the straightforward upload flow make it highly attractive for attackers. Attackers can simply issue a crafted POST request to /cas/fileUpload/upload with a token containing path‑traversal characters, upload a malicious JSP, and then trigger it via a web request, achieving remote code execution with the web‑server privilege level.