Commvault Command Center Unauthenticated Remote Code Execution and Path Traversal Vulnerability Advisory (CVE-2025-34028)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2025-34028) is a critical-severity (CVSS 10.0) unauthenticated Remote Code Execution (RCE) vulnerability affecting the Commvault Command Center Innovation Release. The root cause lies in the lack of proper authentication validation (CWE-306) combined with insufficient path validation (CWE-22, Zip Slip) when extracting uploaded ZIP archive files. An unauthenticated actor can upload a crafted ZIP file representing an installation package, which is subsequently extracted by the target server without path sanitization.

2. Exploitation Mechanics & Attack Scenario

The exploitation flow proceeds as follows: 1) An attacker crafts a malicious ZIP archive containing a JSP web shell, utilizing directory traversal sequences (e.g., '../../') in the file paths. 2) The attacker sends an unauthenticated HTTP request to the installation package upload endpoint of the Command Center. 3) The server processes the upload and extracts the ZIP archive. Due to the lack of path validation, the extraction process escapes the intended directory and writes the JSP file into the web root or another executable directory. 4) The attacker accesses the deployed JSP file via its direct URL, executing arbitrary operating system commands with the privileges of the Commvault application process.

3. Infrastructure & Business Impact

This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog. Successful exploitation grants the attacker complete control over the Commvault server, which manages critical enterprise backup and recovery infrastructure. This can lead to unauthorized access to sensitive backed-up data, data destruction, deployment of ransomware, and lateral movement across the internal network, posing an existential threat to business continuity.