Embed Notice

After successfully touching grass and beginning to write up CVE-2025-34028...

CVE-2025-34028 is a path traversal vulnerability. And yes, the path traversal allows for an unauthenticated attacker to plant files in arbitrary locations. And presumably Commvault has fixed the path traversal part.

BUT, what about the fact that deployCCPackage() is reachable by design (by way of deployServiceCommcell.do being explicitly listed in authSkipRules.xml)?

Directory traversal aside, in what world does the ability for an unauthenticated client to deploy a Command Center package make sense, whatever that means? 🤔