CVE-2025-34028: Commvault Command Center Path Traversal Vulnerability
Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code.
Other sources
The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP.
This issue affects Command Center Innovation Release: 11.38.0 to 11.38.20. The vulnerability is fixed in 11.38.20 with SP38-CU20-433 and SP38-CU20-436 and also fixed in 11.38.25 with SP38-CU25-434 and SP38-CU25-438.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Commvault Command Center Innovation Releaseto a version that resolves this vulnerability.Fixed in 11.38.20Patch SP38-CU20-433 - Upgrade
Upgrade
Commvault Command Center Innovation Releaseto a version that resolves this vulnerability.Fixed in 11.38.20Patch SP38-CU20-436 - Upgrade
Upgrade
Commvault Command Center Innovation Releaseto a version that resolves this vulnerability.Fixed in 11.38.25Patch SP38-CU25-434 - Upgrade
Upgrade
Commvault Command Center Innovation Releaseto a version that resolves this vulnerability.Fixed in 11.38.25Patch SP38-CU25-438 - Compensating control
Follow applicable BOD 22-01 guidance for cloud services.
- Compensating control
Discontinue use of the product if mitigations are unavailable.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34028?
CVE-2025-34028 has a high severity level due to its potential for remote code execution.
How can I fix CVE-2025-34028?
Fix CVE-2025-34028 by applying the latest security patch for Commvault Command Center Innovation Release.
Who is affected by CVE-2025-34028?
CVE-2025-34028 affects users of Commvault Command Center Innovation Release version 11.38.
What types of attacks can CVE-2025-34028 facilitate?
CVE-2025-34028 can facilitate remote code execution attacks by allowing unauthenticated users to upload malicious ZIP files.
What is a path traversal vulnerability in the context of CVE-2025-34028?
In CVE-2025-34028, a path traversal vulnerability enables unauthorized access to sensitive file paths, leading to security breaches.