{"id":"CVE-2025-34028","kind":"vulnerability","aliases":["CVE-2025-34028"],"related":[],"title":"The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent…","description":"The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP.\n\n\n\n\n\nThis issue affects Command Center Innovation Release: 11.38.0 to 11.38.20. The vulnerability is fixed in 11.38.20 with SP38-CU20-433 and SP38-CU20-436 and also fixed in 11.38.25 with SP38-CU25-434 and SP38-CU25-438.","summary":"Commvault Command Center has a path traversal flaw that lets a remote attacker reach files outside the intended directory without logging in. Per the description, it lets that attacker execute arbitrary code.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2025-05-02T00:00:00+00:00","products":[{"name":"Commvault Command Center","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"commvault","fixed":["11.38.20"],"affected":">= 11.38.0, < 11.38.20","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["command-center","commvault","exploited","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the mitigations from Commvault's vendor advisory, per CISA required action; no specific version or setting is named in the sources. If mitigations are unavailable, CISA says to discontinue use of the product.","status":"open","published_at":"2025-04-22T17:16:48+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:48:42+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:48:42Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations from Commvault's vendor advisory, per CISA required action; no specific version or setting is named in the sources. If mitigations are unavailable, CISA says to discontinue use of the product.","reach":"internet","summary":"Commvault Command Center has a path traversal flaw that lets a remote attacker reach files outside the intended directory without logging in. Per the description, it lets that attacker execute arbitrary code.","category":"vendor","who_cares":["commvault","command-center","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated remote attacker executes arbitrary code on the Command Center server.","analyst_note":"Find Commvault's advisory for CVE-2025-34028 to get affected versions, fixed builds, and the specific mitigation steps; the sources give none of these.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000434,"input_tokens":2521,"output_tokens":363,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':18A,21A '-34028':19A,22A '11.38.0':116C '11.38.20':118C,124C '11.38.25':139C '433':129C '434':144C '436':134C '438':149C 'actor':10A,77C 'affect':111C 'allow':7A,74C 'also':136C 'arbitrari':66B 'attack':48B,64B 'center':4A,25A,29B,38B,71C,113C 'code':67B,104C 'command':3A,24A,28B,37B,70C,112C 'command-cent':27B 'commvault':2A,23A,26A,30B,36B,69C 'cu20':128C,133C 'cu25':143C,148C 'cve':17A,20A 'descript':60B 'directori':54B 'execut':65B,105C 'expand':88C 'exploit':31B 'file':14A,50B,81C 'fix':122C,137C 'flaw':43B 'host':34B 'innov':5A,72C,114C 'instal':84C 'intend':53B 'issu':110C 'jsp':108C 'let':45B,62B 'log':56B 'malici':107C 'outsid':51B 'packag':85C 'path':41B,96C 'per':58B 'reach':49B 'releas':6A,73C,115C 'remot':47B,103C 'repres':16A,83C 'result':101C 'self':33B 'self-host':32B 'server':92C 'sp38':127C,132C,142C,147C 'sp38-cu20':126C,131C 'sp38-cu25':141C,146C 'target':91C 'travers':42B,97C 'unauthent':9A,76C 'upload':12A,79C 'vendor':35B 'via':106C 'vulner':94C,98C,120C 'without':55B 'zip':13A,80C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-04-22T17:16:48+00:00","kev":{"dateAdded":"2025-05-02","dueDate":"2025-05-23","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-34028","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-34028","severity":null,"published_at":"2025-05-02T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T16:39:46+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-34028","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-34028","severity":null,"published_at":"2025-04-22T17:16:48+00:00","modified_at":"2026-06-17T09:13:20+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}