Commvault Command Center Path Traversal (CVE-2025-34028)

Historical catalog analysis: CISA added this entry on May 02, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-34028 is a path traversal vulnerability (CWE-22) identified in the Commvault Command Center. The flaw allows a remote, unauthenticated attacker to execute arbitrary code on the affected system. Due to the lack of authentication requirements for exploitation, this represents a significant exposure point for any instance of the product accessible over the network.

Exposure and applicability

This vulnerability applies to organizations deploying Commvault Command Center. The primary risk is the ability of an external actor to bypass intended directory restrictions via path traversal to achieve code execution.

Infrastructure owners should prioritize assets that are exposed to untrusted networks or those residing in segments with limited internal segmentation, as these provide the most direct paths for unauthenticated remote access. CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on May 2, 2025, indicating that it is a priority for remediation.

Remediation priorities

Based on our analysis of the available data, we recommend the following prioritization for vulnerability management teams:

1. Immediate Mitigation Deployment: Apply the mitigations provided in the vendor’s security advisory (CV_2025_04_1). This is the primary method to close the path traversal vector.
2. Cloud Service Review: For organizations utilizing Commvault via cloud services, review and apply guidance consistent with BOD 22-01 to ensure the service provider has addressed the exposure.
3. Asset Decommissioning: In scenarios where vendor mitigations cannot be applied or are unavailable for a specific legacy deployment, the product should be discontinued to eliminate the risk of arbitrary code execution.

How to validate remediation

Verification must go beyond confirming a version number or the presence of a patch. To assure that exposure has been reduced, defenders should focus on the following:

• Functional Validation: Following vendor instructions, verify that the specific path traversal mechanism is no longer viable. This involves ensuring the application correctly sanitizes inputs and restricts file system access to authorized directories.
• Configuration Audit: Confirm that any compensating controls (such as network ACLs or WAF rules) intended to limit access to the Command Center are active and correctly configured, though these should be viewed as secondary to the vendor’s fix.

Limits and open questions

A version check alone does not prove that the arbitrary code execution path is closed; validation must follow the specific steps outlined in the vendor’s security advisory. It remains unknown whether this vulnerability has been utilized by ransomware campaigns. Additionally, while CISA has set a remediation deadline of May 23, 2025, for federal agencies, non-federal organizations must determine their own risk tolerance and patching cadence based on their specific exposure.

Source and editorial note

CVE-2025-34028: Commvault Command Center Path Traversal Vulnerability · Source date: May 02, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: May 05, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 16, 2026 at 00:20 UTC.

Request a Vulnerability Assessment