CVE-2025-34028

An attacker without any authentication (CWE-306) uploads a crafted ZIP archive impersonating an installation package. During extraction, the server does not properly validate the paths contained in the archive (CWE-22 – path traversal), allowing a JSP file to be written to any location accessible to the application server. The malicious JSP file placed this way is then executed by the server, resulting in full Remote Code Execution in the context of the server process.

An attacker gains the ability to execute arbitrary code on the server without any authentication, which in practice means complete takeover of the system, including the ability to compromise the integrity and availability of data managed by Commvault.

Commvault Command Center should be updated to a version containing one of the following patches: SP38-CU20-433 or SP38-CU20-436 (for the 11.38.20 line) or SP38-CU25-434 or SP38-CU25-438 (for the 11.38.25 line). Detailed instructions are available in the vendor's official security bulletin at the address indicated in the references (CV_2025_04_1).

Commvault Command Center Innovation Release in versions from 11.38.0 to 11.38.20 and 11.38.25 (before applying appropriate patches); products running on Microsoft Windows and Linux.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code.