Commvault · Command Center

CVE-2025-34028

Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal

Exploited in attacks Critical 9.3 Attack chance: 98%

What it is

The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP.

This issue affects Command Center Innovation Release: 11.38.0 to 11.38.20. The vulnerability is fixed in 11.38.20 with SP38-CU20-433 and SP38-CU20-436 and also fixed in 11.38.25 with SP38-CU25-434 and SP38-CU25-438.

CISA: Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: May 23, 2025

documentation.commvault.com/securityadvisories/CV_2025_04_1.html

Added to the CISA list: May 2, 2025
Published: April 22, 2025
Severity: Critical 9.3 CVSS 4.0
Chance of attacks in the next 30 days (EPSS): 98% in the top 0.1% of all known vulnerabilities
Weakness: CWE-22
More details: NVD · CVE.org · CISA

All references (4)

More exploited flaws from Commvault

Added	Vulnerability	Product	Severity	Attack chance
Apr 28, 2025	UnspecifiedCVE-2025-3928	Web Server	High 8.7	2.5%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.