CVE-2025-34028: Commvault Command Center Path Traversal Vulnerability

CVE-2025-34028 is a path traversal vulnerability in Commvault Command Center that allows a remote, unauthenticated attacker to execute arbitrary code. Path traversal flaws let attackers reach files or paths outside intended directories; when that access can lead to code execution, the impact is high for any organization that relies on the product for backup and recovery operations.

Because the flaw requires no authentication and can result in remote code execution, it matters for IT and security teams that run Commvault Command Center. Confirm all product-specific details, including exact affected builds and fixed releases, against the vendor advisory before acting.

How it works

The weakness is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). In this class of flaw, user-controlled input that is meant to select a file or path is not sufficiently sanitized. An attacker can insert directory-traversal sequences (commonly “../” style constructs) so that the application resolves a path outside the intended directory tree.

According to the CISA summary, successful abuse of this path traversal in Commvault Command Center can lead to arbitrary code execution by a remote, unauthenticated attacker. Exact request format, parameters, or payload mechanics are not provided in the public summary; treat any exploit details as unconfirmed until verified against the vendor advisory. In general, once an attacker can write or overwrite files in a location the application later executes or interprets, code execution becomes possible.

Am I affected? How to find it in your systems

Commvault Command Center is typically deployed as the web-based management interface for Commvault backup and recovery environments. It often runs on dedicated management servers or appliances that are reachable by administrators and, in some architectures, by other systems that need to interact with the backup platform.

• Inventory all hosts and virtual machines that run Commvault Command Center or related management components. Check asset-management databases, CMDB entries, and software-inventory tools for Commvault products.
• Review network diagrams and firewall rules for any exposure of the Command Center web interface to untrusted networks or the internet.
• Confirm the installed version and build against the vendor’s advisory for CVE-2025-34028; only the vendor can state which releases are vulnerable.
• Examine web-server and application logs for unusual path strings containing traversal sequences, unexpected file-access errors, or anomalous requests to endpoints that handle file paths. Correlate with authentication logs to identify unauthenticated activity.
• If the product is offered as a cloud service, follow the applicable BOD 22-01 guidance referenced by CISA and confirm with the provider whether the instance is patched.

How to remediate

The primary remediation is to apply the vendor-supplied update or mitigation instructions for CVE-2025-34028. CISA’s required action is to apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

• Obtain the fixed package or configuration guidance directly from Commvault and deploy it through your normal change-control process.
• After patching, re-verify the version and perform a limited functional test of backup and restore workflows.
• For this class of vulnerability, ensure that any path-handling code or configuration that accepts user input is restricted to a tightly defined allow-list of directories and that the application process runs with least privilege.
• Harden the management interface: require strong authentication, restrict network access to authorized administrative networks, and enable detailed logging of file-system operations.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls appropriate to a remote, unauthenticated path-traversal issue that can lead to code execution.

• Segment the Command Center host so that it is reachable only from trusted administrative jump hosts or management VLANs; block direct internet or broad internal access.
• If a web application firewall or reverse proxy sits in front of the interface, consider temporary virtual-patching rules that reject requests containing path-traversal sequences. Validate any such rules carefully to avoid breaking legitimate operations.
• Disable or restrict any optional features that accept file-path input if the vendor documentation indicates they are not required for core backup functions.
• Increase monitoring: alert on anomalous web requests, unexpected process creation, or file writes outside normal Commvault directories. Retain logs long enough for forensic review.
• If mitigations cannot be implemented and the risk is unacceptable, follow CISA guidance and consider discontinuing use of the product until a fix is available.

If your data may have been exposed

Actively exploited remote-code-execution vulnerabilities can lead to full compromise of the affected host and, depending on the privileges of the Commvault service account, access to backup catalogs, credentials, or stored data. Known ransomware use of this specific CVE is not documented. If you suspect exploitation, isolate the system, preserve logs and memory images, and begin incident-response procedures. You can also run a free exposure scan of your email addresses against known breach data to check whether related credentials have appeared in public dumps.