CVE-2025-34028criticalunder attackCWE-22CWE-306

CVE-2025-34028: critical vulnerability in Commvault Command Center Innovation Release

Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal

Published · Updated

Follow this CVE+ Monitor Command Center Innovation

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.3epss 98%
from disclosure to weaponsame day
Published on NVDApr 22
1st PoCApr 17
CISA KEV+10d
Action required by CISAfederal deadline: 2025-05-23

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

An unauthenticated attacker can upload a malicious ZIP file to Commvault Command Center that exploits a path traversal flaw during extraction, allowing them to place and execute harmful code on the server.

Technical detail

CVE-2025-34028 involves an unauthenticated path traversal vulnerability in Commvault Command Center Innovation Release (versions 11.38.0–11.38.20) during ZIP package extraction. An attacker can craft a malicious install package with specially crafted paths that bypass directory restrictions, enabling arbitrary file placement and Remote Code Execution via JSP injection without requiring authentication.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP. This issue affects Command Center Innovation Release: 11.38.0 to 11.38.20. The vulnerability is fixed in 11.38.20 with SP38-CU20-433 and SP38-CU20-436 and also fixed in 11.38.25 with SP38-CU25-434 and SP38-CU25-438.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H
Affected products
Commvault · Command Center Innovation Release
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.