---
id: "CVE-2025-34028"
kind: "vulnerability"
aliases: ["CVE-2025-34028"]
title: "The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent\u2026"
severity: "critical"
cvss: 10.0
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Commvault Command Center", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "commvault", "fixed": ["11.38.20"], "affected": ">= 11.38.0, < 11.38.20", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["command-center", "commvault", "exploited", "self-hosted", "vendor"]
not_affected_if: ["unknown"]
published_at: "2025-04-22T17:16:48+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-34028", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34028", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent…

Commvault Command Center has a path traversal flaw that lets a remote attacker reach files outside the intended directory without logging in. Per the description, it lets that attacker execute arbitrary code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Commvault Command Center affected ? fixed ?
- vendor:commvault affected >= 11.38.0, < 11.38.20 fixed 11.38.20

## Fix

Apply the mitigations from Commvault's vendor advisory, per CISA required action; no specific version or setting is named in the sources. If mitigations are unavailable, CISA says to discontinue use of the product.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-34028
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-34028

## From the sources

The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP.





This issue affects Command Center Innovation Release: 11.38.0 to 11.38.20. The vulnerability is fixed in 11.38.20 with SP38-CU20-433 and SP38-CU20-436 and also fixed in 11.38.25 with SP38-CU25-434 and SP38-CU25-438.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_