CVE-2015-3203

Status: ModifiedHigh (7.5)—Exploit

Severity7.5High · CVSS 2.0

Exploitation probability9.44 %higher than 95% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitAvailablePublished on Exploit-DB

Unrestricted file upload vulnerability in h5ai before 0.25.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the directory specified by the href parameter.

CVSS

Base score: 7.5
Version: 2.0
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 9.44 %
Percentile among all scored CVEs: 95
Score date: 10/22/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

Published on Exploit-DB · h5ai < 0.25.0 - Unrestricted Arbitrary File Upload (9/22/2015)

Affected technologies (1)

H5ai Project — H5ai

CWEs

NVD-CWE-Other

References

Show 4 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2015-3203",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-09-28T16:59:00.100",
  "references": [
    {
      "url": "https://larsjung.de/h5ai/cve-2015-3203.txt",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://www.exploit-db.com/exploits/38256/",
      "tags": [
        "Exploit"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://larsjung.de/h5ai/cve-2015-3203.txt",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/38256/",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unrestricted file upload vulnerability in h5ai before 0.25.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the directory specified by the href parameter."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de subida de archivo no restringido en h5ai en versiones anteriores a 0.25.0, permite a atacantes remotos ejecutar código arbitrario mediante la carga de un archivo con una extensión ejecutable accediendo entonces a él a través de una petición directa al archivo en el directorio especificado mediante el parámetro href."
    }
  ],
  "lastModified": "2026-06-17T00:25:31.957",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:h5ai_project:h5ai:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E0909DF-5EB1-4EFA-8870-39D0699E7B3B",
              "versionEndIncluding": "0.24.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/434.html\">CWE-434: Unrestricted Upload of File with Dangerous Type</a>",
  "sourceIdentifier": "secalert@redhat.com"
}