{"id":"CVE-2025-34028","published":"2025-04-22T17:16:48Z","modified":"2026-06-17T09:13:20Z","title":"Commvault Command Center Path Traversal Vulnerability","vendor":"Commvault","product":"Command Center","tier":"core","eol":null,"description":{"text":"The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP.\n\n\n\n\n\nThis issue affects Command Center Innovation Release: 11.38.0 to 11.38.20. The vulnerability is fixed in 11.38.20 with SP38-CU20-433 and SP38-CU20-436 and also fixed in 11.38.25 with SP38-CU25-434 and SP38-CU25-438.","provenance":"source","from":"NVD"},"summary":{"text":"Commvault Command Center contains a path traversal flaw in its handling of uploaded ZIP install packages, which the server expands without restricting where files are written. An unauthenticated remote attacker who can reach the Command Center service can upload a crafted ZIP archive, and no user interaction or prior authentication is required, so the attacker can write a malicious JSP file to a location the server will execute, achieving remote code execution.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:35:52Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.97604,"percentile":0.99902,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-05-02","dueDate":"2025-05-23","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://documentation.commvault.com/securityadvisories/CV_2025_04_1.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-34028","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-04-30","exploitedFirstSeen":"2025-04-30","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-04-30&host_type=src&vulnerability=cve-2025-34028","date":"2025-04-30"},{"url":"https://fortiguard.fortinet.com/outbreak-alert/commvault-cc-path-traversal","date":"2025-05-01"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-05-02&host_type=src&vulnerability=cve-2025-34028","date":"2025-05-02"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-05-02"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-05-03&host_type=src&vulnerability=cve-2025-34028","date":"2025-05-03"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-05-05&host_type=src&vulnerability=cve-2025-34028","date":"2025-05-05"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-05-09&host_type=src&vulnerability=cve-2025-34028","date":"2025-05-09"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-05-11&host_type=src&vulnerability=cve-2025-34028","date":"2025-05-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-05-12&host_type=src&vulnerability=cve-2025-34028","date":"2025-05-12"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-05-13&host_type=src&vulnerability=cve-2025-34028","date":"2025-05-13"}],"evidenceTotal":271,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"},{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"https://documentation.commvault.com/securityadvisories/CV_2025_04_1.html","tags":["Vendor Advisory"]},{"url":"https://github.com/watchtowrlabs/watchTowr-vs-Commvault-PreAuth-RCE-CVE-2025-34028","tags":["Exploit"]},{"url":"https://labs.watchtowr.com/fire-in-the-hole-were-breaching-the-vault-commvault-remote-code-execution-cve-2025-34028/","tags":["Third Party Advisory"]},{"url":"https://www.vulncheck.com/advisories/commvault-command-center-innovation-release-unauthenticated-install-package-path-traversal","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34028","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Server-Side Request Forgery (SSRF)","mappingType":"exploitation_technique","evidence":[],"comment":"Due to an issue with deployWebpackage.do, Commvault Command Center is vulnerable to SSRF attacks due to flawed host filtering, which an attacker can exploit to achieve remote code execution using malicious archives with .jsp files in them.","confidence":"high"},{"id":"T1059.007","name":"JavaScript","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Server-Side Request Forgery (SSRF)","mappingType":"primary_impact","evidence":[],"comment":"Due to an issue with deployWebpackage.do, Commvault Command Center is vulnerable to SSRF attacks due to flawed host filtering, which an attacker can exploit to achieve remote code execution using malicious archives with JavaScript files in them.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-12275","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-12275","exploited":true,"exploitedSince":"2025-05-02","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":4,"skipped":0,"earliest":"2025-04-17","earliestUrl":"https://github.com/watchtowrlabs/watchTowr-vs-Commvault-PreAuth-RCE-CVE-2025-34028","repos":[{"name":"watchtowrlabs/watchTowr-vs-Commvault-PreAuth-RCE-CVE-2025-34028","url":"https://github.com/watchtowrlabs/watchTowr-vs-Commvault-PreAuth-RCE-CVE-2025-34028","stars":21,"created":"2025-04-17"},{"name":"Mattb709/CVE-2025-34028-PoC-Commvault-RCE","url":"https://github.com/Mattb709/CVE-2025-34028-PoC-Commvault-RCE","stars":2,"created":"2025-05-06"},{"name":"becrevex/Commvault-CVE-2025-34028","url":"https://github.com/becrevex/Commvault-CVE-2025-34028","stars":1,"created":"2025-05-06"},{"name":"tinkerlev/commvault-cve2025-34028-check","url":"https://github.com/tinkerlev/commvault-cve2025-34028-check","stars":0,"created":"2025-04-24"}]},"nuclei":[{"id":"CVE-2025-34028","name":"Commvault - SSRF via /commandcenter/deployWebpackage.do","severity":"critical","path":"http/cves/2025/CVE-2025-34028.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34028.yaml"}],"first":{"date":"2025-04-17","source":"PoC-in-GitHub","url":"https://github.com/watchtowrlabs/watchTowr-vs-Commvault-PreAuth-RCE-CVE-2025-34028"},"provenance":"source"},"exploitRefs":["https://github.com/watchtowrlabs/watchTowr-vs-Commvault-PreAuth-RCE-CVE-2025-34028"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1059.007"],"provenance":"source"}],"timeline":[{"date":"2025-04-17","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/watchtowrlabs/watchTowr-vs-Commvault-PreAuth-RCE-CVE-2025-34028","provenance":"source"},{"date":"2025-04-22","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-34028","provenance":"source"},{"date":"2025-04-30","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-04-30&host_type=src&vulnerability=cve-2025-34028","provenance":"source"},{"date":"2025-05-02","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-05-02","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-12275","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":10},"priority":{"score":70.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 548 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9990"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 4 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}