Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Commvault Command Center Innovation Release is affected, allowing an unauthenticated attacker to upload crafted installation package files that, when extracted by the server, can write files outside their intended location and lead to remote code execution through a malicious JSP file.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP. This issue affects Command Center Innovation Release: 11.38.0 to 11.38.20. The vulnerability is fixed in 11.38.20 with SP38-CU20-433 and SP38-CU20-436 and also fixed in 11.38.25 with SP38-CU25-434 and SP38-CU25-438.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Commvault Command Center Innovation Release
From 11.38.0 · through 11.38.25
References 4
documentation.commvault.com
labs.watchtowr.com
GitHub · watchtowrlabs/watchTowr-vs-Commvault-PreAuth-RCE-CVE-2025-34028
Questions about CVE-2025-34028
What does this mean?
A path traversal flaw in the Command Center install package handling, requiring no login, can lead to arbitrary code execution on the Command Center server. The vendor says this could result in a complete compromise of the Command Center environment.Source: documentation.commvault.com
Am I affected, and how do I check?
Linux and Windows installations of the Command Center Innovation Release 11.38 line are affected. The advisory lists 11.38.0 through 11.38.19, while the range data runs through 11.38.25, so a reader should check the installed version against the vendor advisory. Only the 11.38 Innovation Release is affected.Source: documentation.commvault.com
What should I do about it?
Install an Innovation Update release that contains the fix. The checked facts do not list the specific fixed version numbers, so confirm the target release in the vendor advisory.Source: documentation.commvault.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-05-02, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data
What if there's no patch?
If installing the update is not feasible, isolate the Command Center installation from external network access.Source: documentation.commvault.com