Critical severity · published Apr 22, 2025
CVE-2025-34028
Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal
In wildKEV
10.0
CVSS
97.6%
EPSS
Yes
On KEV
Description
The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP.
This issue affects Command Center Innovation Release: 11.38.0 to 11.38.20. The vulnerability is fixed in 11.38.20 with SP38-CU20-433 and SP38-CU20-436 and also fixed in 11.38.25 with SP38-CU25-434 and SP38-CU25-438.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)97.6% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed May 2, 2025
Federal remediation dueMay 23, 2025
Ransomware campaign useNot known
Affected products
Which versions
CC
Command Center Innovation Release · Commvault
11.38.0 through 11.38.25 · source: vendor
CO
Commvault · Commvault
11.38.0 before 11.38.20 · source: NVD
CC
Command Center · Commvault
All versions, or not specified · source: KEV
Affected product
CC
Command Center Innovation Release
Commvault
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-34028
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-34028
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
vendor-advisory
https://documentation.commvault.com/securityadvisories/CV_2025_04_1.html
exploit
https://labs.watchtowr.com/fire-in-the-hole-were-breaching-the-vault-commvault-remote-code-execution-cve-2025-34028/
exploit
https://github.com/watchtowrlabs/watchTowr-vs-Commvault-PreAuth-RCE-CVE-2025-34028
third-party-advisory
https://www.vulncheck.com/advisories/commvault-command-center-innovation-release-unauthenticated-install-package-path-traversal