CVE-2025-34028
Commvault Command Center Path Traversal Vulnerability
Description
CVE-2025-34028 is a critical unauthenticated remote code execution vulnerability in Commvault Command Center Innovation Release, a centralized management platform for enterprise data protection and backup infrastructure. The vulnerability allows an unauthenticated attacker to upload specially crafted ZIP files that exploit a path traversal flaw during server-side extraction, enabling placement and execution of malicious JSP files on the server. With a maximum CVSS v3.1 base score of 10.0 (Critical), this is among the most severe vulnerabilities possible. CISA added CVE-2025-34028 to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 23, 2025, and its EPSS score of 51.06% at the 97th percentile reflects very high exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| commvault | commvault | >= 11.38.0, < 11.38.20 |
References
- https://documentation.commvault.com/securityadvisories/CV_2025_04_1.html(Vendor Advisory)
- https://github.com/watchtowrlabs/watchTowr-vs-Commvault-PreAuth-RCE-CVE-2025-34028(Exploit)
- https://labs.watchtowr.com/fire-in-the-hole-were-breaching-the-vault-commvault-remote-code-execution-cve-2025-34028/(Third Party Advisory)
- https://www.vulncheck.com/advisories/commvault-command-center-innovation-release-unauthenticated-install-package-path-traversal(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34028(US Government Resource)
Weakness Type
CWE-22: Path Traversal
CVE-2025-34028 involves CWE-22, Improper Limitation of a Pathname to a Restricted Directory (Path Traversal). The Commvault Command Center fails to properly validate file paths within uploaded ZIP archives during the install package extraction process. An attacker can craft ZIP entries with directory traversal sequences (e.g., ../) that cause files to be extracted outside the intended directory, enabling placement of malicious files in executable locations on the server.
Learn more: CWE-22 — Path Traversal
CWE-306: Missing Authentication for Critical Function
The vulnerability also involves CWE-306, as the ZIP file upload functionality that handles install packages does not require authentication. This allows any unauthenticated network-reachable actor to upload malicious packages, bypassing all access controls on the Commvault Command Center.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
CVE-2025-34028 carries the absolute maximum CVSS v3.1 score of 10.0 (Critical), the highest severity rating achievable. The vulnerability is network-accessible (AV:N) with low complexity (AC:L), requires no authentication (PR:N) and no user interaction (UI:N), and has a changed scope (S:C), meaning the compromised component can affect resources beyond its own security authority. All three impact dimensions are rated high. Confidentiality is completely compromised as the attacker gains code execution on the Commvault server, which manages enterprise backup data, credentials for protected systems, and potentially contains copies of entire organizational datasets. Integrity faces maximum impact because the attacker can modify backup configurations, corrupt backup data, inject malicious content into backup archives, and establish persistent access. Availability is fully at risk since the attacker can disrupt backup operations, delete recovery points, and render disaster recovery capabilities inoperable. Compromising a Commvault Command Center is catastrophic because it represents the organization's last line of defense for data recovery, making it a prime target for ransomware operators.
Exploit Maturity
CVE-2025-34028 demonstrates very high exploit maturity with confirmed active exploitation. Public exploit code is available via the watchTowr Labs GitHub repository, and a detailed technical writeup is available from watchTowr Labs. CISA confirmed active exploitation by adding CVE-2025-34028 to the Known Exploited Vulnerabilities catalog on May 2, 2025. The EPSS score of 51.06% at the 97th percentile indicates that exploitation is very likely for any exposed instance. The availability of a complete working exploit, combined with the high value of backup infrastructure as a target, makes this one of the most dangerous actively exploited vulnerabilities in the enterprise backup space.
Remediation
-
Apply the Commvault security patches immediately. For Command Center Innovation Release 11.38.0 through 11.38.19, update to 11.38.20 with hotfixes SP38-CU20-433 and SP38-CU20-436. Alternatively, update to 11.38.25 with SP38-CU25-434 and SP38-CU25-438. Refer to the Commvault security advisory CV_2025_04_1 for detailed instructions.
-
Restrict network access to the Command Center web interface immediately as an interim mitigation. The management interface should only be accessible from trusted management networks, never exposed to the internet or untrusted network segments.
-
Conduct a forensic investigation of the Commvault environment. Check web server logs for suspicious ZIP file uploads, verify the integrity of installed JSP files, and search for unauthorized files or web shells in the Command Center deployment directory.
-
Verify the integrity of backup data and configurations by reviewing backup job histories, checking for unauthorized configuration changes, and validating that recovery points have not been tampered with or deleted.
-
Implement a web application firewall (WAF) in front of the Commvault Command Center to detect and block path traversal attempts in file uploads, and establish ongoing monitoring for exploitation attempts against the install package upload functionality.
Technical Details
CVE-2025-34028 combines path traversal (CWE-22) and missing authentication (CWE-306) to achieve unauthenticated remote code execution in Commvault Command Center Innovation Release. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields the maximum score of 10.0, with the changed scope (S:C) reflecting the ability to compromise systems beyond the Commvault Command Center itself, including protected backup targets and connected infrastructure. The vulnerability exists in the install package upload functionality, which accepts ZIP files from unauthenticated users. When the server extracts the uploaded ZIP archive, it fails to validate or sanitize file paths within the archive entries. An attacker crafts a ZIP file containing entries with path traversal sequences that, upon extraction, place a malicious JSP file in a web-accessible directory on the Commvault server. The server's Java application container then serves and executes this JSP file, providing the attacker with arbitrary code execution. The affected versions span Command Center Innovation Release 11.38.0 through 11.38.19, with fixes delivered in versions 11.38.20 and 11.38.25.
Frequently Asked Questions
Is CVE-2025-34028 being actively exploited?
Yes. CISA confirmed active exploitation by adding CVE-2025-34028 to the KEV catalog on May 2, 2025. Public exploit code is available from watchTowr Labs, and the EPSS score of 51.06% at the 97th percentile confirms very high exploitation probability.
What products are affected by CVE-2025-34028?
Commvault Command Center Innovation Release versions 11.38.0 through 11.38.19 are affected. The vulnerability is fixed in version 11.38.20 (with specific hotfixes) and version 11.38.25.
How do I fix CVE-2025-34028?
Update Commvault Command Center to version 11.38.20 with hotfixes SP38-CU20-433 and SP38-CU20-436, or to version 11.38.25 with SP38-CU25-434 and SP38-CU25-438. As an immediate interim measure, restrict network access to the Command Center management interface.
How severe is CVE-2025-34028?
CVE-2025-34028 has the maximum possible CVSS score of 10.0, reflecting unauthenticated remote code execution with cross-boundary impact. Compromising backup infrastructure is particularly devastating as it can undermine an organization's entire data recovery capability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.