Vulnerability Details CVE-2025-34028
The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP.
This issue affects Command Center Innovation Release: 11.38.0 to 11.38.20. The vulnerability is fixed in 11.38.20 with SP38-CU20-433 and SP38-CU20-436 and also fixed in 11.38.25 with SP38-CU25-434 and SP38-CU25-438.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.676
EPSS Ranking 98.5%
CVSS Severity
CVSS v3 Score 10.0
Proposed Action
Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code.
Ransomware Campaign
Unknown
References
Products affected by CVE-2025-34028
-
cpe:2.3:a:commvault:commvault:11.38.0
-
cpe:2.3:a:commvault:commvault:11.38.1
-
cpe:2.3:a:commvault:commvault:11.38.10
-
cpe:2.3:a:commvault:commvault:11.38.11
-
cpe:2.3:a:commvault:commvault:11.38.12
-
cpe:2.3:a:commvault:commvault:11.38.13
-
cpe:2.3:a:commvault:commvault:11.38.14
-
cpe:2.3:a:commvault:commvault:11.38.15
-
cpe:2.3:a:commvault:commvault:11.38.16
-
cpe:2.3:a:commvault:commvault:11.38.17
-
cpe:2.3:a:commvault:commvault:11.38.18
-
cpe:2.3:a:commvault:commvault:11.38.2
-
cpe:2.3:a:commvault:commvault:11.38.3
-
cpe:2.3:a:commvault:commvault:11.38.5
-
cpe:2.3:a:commvault:commvault:11.38.6
-
cpe:2.3:a:commvault:commvault:11.38.7
-
cpe:2.3:a:commvault:commvault:11.38.8
-
cpe:2.3:a:commvault:commvault:11.38.9
-
cpe:2.3:o:linux:linux_kernel:-
-
cpe:2.3:o:microsoft:windows:-