CVE-2025-34028

What it actually does

CVE-2025-34028 is an unauthenticated path traversal vulnerability in Commvault Command Center Innovation Release 11.38.0 through affected 11.38.20 builds. The vulnerable package-upload workflow accepts ZIP-based install packages and expands their contents on the server without sufficiently preventing ZIP entries from escaping the intended extraction directory. An attacker can craft a ZIP archive containing traversal paths that write a malicious JSP into a web-accessible Tomcat directory. Once the JSP is reachable over HTTP, the attacker can execute arbitrary commands in the context of the Commvault web application service account, resulting in full remote code execution. The issue is high risk because no authentication is required, exploitation can be performed remotely, and successful exploitation can provide direct code execution on backup-management infrastructure.

Why it matters to the business

Successful exploitation can give an attacker control of a Commvault Command Center server, which is highly sensitive because backup platforms often have privileged access to protected systems, backup data, credentials, and recovery workflows. An attacker could steal or destroy backup data, disable recovery capabilities, pivot to managed infrastructure, deploy persistence, or prepare for extortion activity. The vulnerability has a CVSS score of 10.0, a very high EPSS score of 0.97657, is listed in CISA KEV, and is known to be exploited in the wild; the CISA remediation due date was 2025-05-23, so any remaining exposure should be treated as urgent and potentially already targeted.

How an attack unfolds

An attacker first identifies an internet-accessible or internally reachable Commvault Command Center Innovation Release instance running a vulnerable 11.38.x build. They then send an unauthenticated request to the package upload or deployment functionality with a malicious ZIP archive. The archive contains path traversal entries such as parent-directory sequences that cause the server-side extractor to write a JSP file outside the intended package directory and into a web-served application path. After upload and extraction, the attacker sends an HTTP request to the dropped JSP. The JSP executes attacker-supplied commands or provides a web shell, allowing the attacker to run operating-system commands as the Commvault web service user. From there, the attacker may enumerate the host, read configuration and credential material, access backup-management functions, stage additional tools, create persistence, move laterally, or tamper with backup and recovery data. Public exploitation activity and KEV inclusion mean opportunistic scanning and targeted exploitation should be expected.

How to fix it

Upgrade affected Commvault Command Center Innovation Release deployments immediately. The vendor states that affected versions are 11.38.0 through 11.38.20. Fixed builds include 11.38.20 with SP38-CU20-433 or SP38-CU20-436, and 11.38.25 with SP38-CU25-434 or SP38-CU25-438. If immediate upgrade is not possible, restrict network access to Command Center to trusted administrative networks or VPNs, remove internet exposure, enforce allowlisting at firewalls and reverse proxies, and monitor or temporarily disable vulnerable package upload/deployment functionality if operationally feasible. Because exploitation can drop persistent JSP web shells, patching alone is not sufficient for systems that were exposed before remediation; perform compromise assessment, remove unauthorized files, rotate credentials associated with the Commvault server and service accounts, and review backup integrity and administrative activity.

How to confirm the fix worked

Confirm the installed Commvault Command Center Innovation Release version and cumulative update level from the product console, server package inventory, or vendor-supported version command, and verify it is at least one of the fixed builds: 11.38.20 with SP38-CU20-433 or SP38-CU20-436, or 11.38.25 with SP38-CU25-434 or SP38-CU25-438. Verify that Command Center is not directly reachable from the public internet unless explicitly required and protected by compensating controls. Review web server and reverse-proxy logs to ensure unauthenticated ZIP upload attempts are blocked or absent after remediation. Inspect Tomcat and Command Center web application directories for unexpected JSP files, recently modified files, or files owned by the web service account in unusual locations. If possible, test with a benign ZIP-slip validation archive in a non-production environment to confirm traversal entries are rejected or safely normalized by the patched build.

Typical attack path

1. Scan for exposed Commvault Command Center Innovation Release instances and fingerprint the 11.38.x web interface.
2. Confirm the instance is running an affected build or attempt exploitation opportunistically against the vulnerable package-deployment endpoint.
3. Create a ZIP archive containing traversal paths that place a malicious JSP into a web-accessible Tomcat or Command Center directory.
4. Upload the crafted ZIP through the unauthenticated package upload or deployment workflow.
5. Request the newly written JSP over HTTP or HTTPS to execute commands on the server.
6. Use the resulting code execution to enumerate the system, dump configuration, collect credentials, and assess Commvault privileges.
7. Establish persistence or deploy additional tooling such as web shells, reverse shells, credential harvesters, or remote-access utilities.
8. Access, exfiltrate, alter, or delete backup-related data, and pivot to other systems reachable from the backup-management environment.

How to detect it

Investigate both pre-patch and post-patch activity. Review internet-facing telemetry, reverse-proxy logs, WAF logs, Commvault web logs, Tomcat access logs, application logs, EDR telemetry, and file integrity monitoring. Look for unauthenticated POST requests to Command Center package deployment or upload endpoints carrying ZIP files, especially multipart requests containing traversal sequences such as ../, ..\, URL-encoded traversal, or suspicious ZIP filenames. Correlate those upload events with later GET or POST requests to newly created JSP files. On the host, search Tomcat and Command Center web application directories for JSP files created near the time of suspicious uploads, files with web-shell-like parameters, or files not present in a known-good installation. Review process telemetry for Java, Tomcat, or Commvault web-service processes spawning shell interpreters such as cmd.exe, powershell.exe, sh, bash, curl, wget, certutil, or Python. Examine outbound network connections from the Command Center server following suspicious JSP access, especially connections to unknown IP addresses, reverse-shell ports, file-sharing services, or command-and-control infrastructure. Because exploitation is known in the wild, absence of a blocked request is not enough; systems exposed before patching should receive file-system, process, credential, and backup-integrity review.

• POST /commandcenter/deployWebpackage.do
• deployWebpackage.do
• multipart/form-data
• PK\u0003\u0004
• ../
• ..\\
• %2e%2e%2f
• %2e%2e/
• ..%2f
• %252e%252e%252f
• .jsp?cmd=
• .jsp?command=
• .jsp?exec=
• .jsp?shell=
• GET /commandcenter/*.jsp
• POST /commandcenter/*.jsp
• /opt/commvault/ContentStore/Apache/tomcat/webapps/
• /opt/commvault/Base/Apache/tomcat/webapps/
• C:\\Program Files\\Commvault\\ContentStore\\Apache\\tomcat\\webapps\\
• C:\\Program Files\\Commvault\\Base\\Apache\\tomcat\\webapps\\
• java.exe spawning cmd.exe
• java.exe spawning powershell.exe
• java spawning /bin/sh
• java spawning /bin/bash
• org.apache.catalina.core.ApplicationFilterChain
• javax.servlet.jsp.JspServlet

What your security team should do

• Treat all exposed vulnerable Commvault Command Center instances as high-priority incident-response candidates because this vulnerability is KEV-listed, has active in-the-wild exploitation, and has a very high EPSS score.
• Upgrade immediately to a vendor-fixed build: 11.38.20 with SP38-CU20-433 or SP38-CU20-436, or 11.38.25 with SP38-CU25-434 or SP38-CU25-438.
• Remove public internet exposure for Command Center and limit access to trusted administrative networks, VPNs, or zero-trust access controls.
• Search historical HTTP, reverse-proxy, WAF, and application logs for unauthenticated ZIP uploads, traversal strings, and subsequent requests to newly created JSP files.
• Hunt file systems for unauthorized JSP files in Commvault, Tomcat, Apache, and Command Center web directories, especially files created or modified around suspicious upload events.
• If exploitation is suspected, preserve forensic evidence, isolate the host, collect volatile data, and investigate for web shells, child processes spawned by Java or Tomcat, credential theft, and lateral movement.
• Rotate credentials, API keys, service account secrets, and stored credentials accessible from the Commvault Command Center server if compromise cannot be ruled out.
• Review backup job history, administrative changes, retention-policy changes, deletion events, and restore-point integrity for signs of tampering.
• Deploy SIEM detections for traversal sequences in ZIP upload requests and for web-server requests to suspicious JSP files under Command Center paths.
• Prioritize this remediation ahead of routine patching because the CISA KEV due date has passed and exploitation is active.