# CVE-2025-34028: Commvault Command Center Path Traversal Vulnerability

- Exploited (CISA KEV): yes, added 2025-05-02
- Published: 2025-04-22
- CVSS: 9.3 CRITICAL (v4.0)
- EPSS: 97.6% (100th percentile)
- CWE: CWE-22, CWE-306

The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP.





This issue affects Command Center Innovation Release: 11.38.0 to 11.38.20. The vulnerability is fixed in 11.38.20 with SP38-CU20-433 and SP38-CU20-436 and also fixed in 11.38.25 with SP38-CU25-434 and SP38-CU25-438.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Blocks by default | 2025-05-19 | 27 |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2025-06-30 | 69 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Cloudflare

- 2025-05-19 · new · rule 28a22a685bba478d99bc904526a517f1 · default Block
  > Commvault Command Center - Remote Code Execution - CVE:CVE-2025-34028. Previous action: Log. New action: Block. This is a New Detection
  Source: https://developers.cloudflare.com/changelog/post/2025-05-19-waf-release/

### F5

- 2025-06-30 · new · rule 200007091
  > Added: signature 200007091 "Commvault Path Traversal" (Path Traversal, risk High), systems: Other Web Server. References: CVE-2025-34028.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

## Our test (measured)

- OWASP Core Rule Set 4.25.0, paranoia level 1, anomaly threshold 5, default CRS settings: passed (0 of 1 requests blocked), template CVE-2025-34028, 2026-11-02
- OWASP Core Rule Set 4.25.0, paranoia level 2, anomaly threshold 5, default CRS settings: passed (0 of 1 requests blocked), template CVE-2025-34028, 2026-11-02

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2025-34028 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2025-34028