Vulnerability details
CVE-2025-34028
Actively exploitedCommvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal
Remedy
Required action (CISA): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (due: 2025-05-23)
Official description
The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP. This issue affects Command Center Innovation Release: 11.38.0 to 11.38.20. The vulnerability is fixed in 11.38.20 with SP38-CU20-433 and SP38-CU20-436 and also fixed in 11.38.25 with SP38-CU25-434 and SP38-CU25-438.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.3Critical | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Commvault | Command Center Innovation Release | 11.38.0 ≤ v ≤ 11.38.25 | CVEProject cvelistV5 (CNA) |
References and advisories
5- https://documentation.commvault.com/securityadvisories/CV_2025_04_1.html vendor-advisory
- https://labs.watchtowr.com/fire-in-the-hole-were-breaching-the-vault-commvault-remote-code-execution-cve-2025-34028/ exploit
- https://github.com/watchtowrlabs/watchTowr-vs-Commvault-PreAuth-RCE-CVE-2025-34028 exploit
- https://www.vulncheck.com/advisories/commvault-command-center-innovation-release-unauthenticated-install-package-path-traversal third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34028 government-resource
Details
- Published
- 2025-04-22
- Last updated
- 2025-11-29
- State
- Published
- Assigner (CNA)
- VulnCheck
- Kolun priority
- 89 · Critical
CISA KEV catalog
- Date added
- 2025-05-02
- Due date
- 2025-05-23
- Used in ransomware
- Unknown
Exploit prediction (EPSS)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Active
- Technical impact
- Total
Weaknesses (CWE)
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CWE-306Missing Authentication for Critical Function