CVE-2025-34028 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the t…
Critical KEV CVSS: 9.3

CVE-2025-34028

The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP.





This issue affects Command Center Innovation Release: 11.38.0 to 11.38.20. The vulnerability is fixed in 11.38.20 with SP38-CU20-433 and SP38-CU20-436 and also fixed in 11.38.25 with SP38-CU25-434 and SP38-CU25-438.
Vendor
Commvault
Product
Commvault
CWE
CWE-22
Yayın Tarihi
2025-04-22 17:16:48
Güncelleme
2025-11-06 13:57:56
Source Identifier
disclosure@vulncheck.com
KEV Date Added
2025-05-02

Kategoriler

CWE-22 Commvault CRITICAL Commvault 2025

Referanslar

https://documentation.commvault.com/securityadvisories/CV_2025_04_1.html https://github.com/watchtowrlabs/watchTowr-vs-Commvault-PreAuth-RCE-CVE-2025-34028 https://labs.watchtowr.com/fire-in-the-hole-were-breaching-the-vault-commvault-remote-code-execution-cve-2025-34028/ https://www.vulncheck.com/advisories/commvault-command-center-innovation-release-unauthenticated-install-package-path-traversal https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34028