What’s Vulnerable › Vulnerabilities

CVE-2025-34028: Commvault Command Center Path Traversal Vulnerability

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2025-05-02
• EPSS: 97.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-04-22 · updated 2026-06-17
• Weakness: CWE-22

Description

The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP. This issue affects Command Center Innovation Release: 11.38.0 to 11.38.20. The vulnerability is fixed in 11.38.20 with SP38-CU20-433 and SP38-CU20-436 and also fixed in 11.38.25 with SP38-CU25-434 and SP38-CU25-438.

Affected products

• Commvault Cloud: from 11.38.0 before 11.38.20 — fixed in 11.38.20

How to fix

Upgrade to a fixed version: Commvault Cloud 11.38.20. Check the vendor advisory for mitigations.

References

• https://documentation.commvault.com/securityadvisories/CV_2025_04_1.html
• https://github.com/watchtowrlabs/watchTowr-vs-Commvault-PreAuth-RCE-CVE-2025-34028
• https://labs.watchtowr.com/fire-in-the-hole-were-breaching-the-vault-commvault-remote-code-execution-cve-2025-34028/
• https://www.vulncheck.com/advisories/commvault-command-center-innovation-release-unauthenticated-install-package-path-traversal
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34028

Get alerted when CVE-2025-34028 or the next vulnerability affects your stack