CVE-2025-57790: Commvault Path Traversal Vulnerability

CVE-2025-57790 Overview

CVE-2025-57790 is a path traversal vulnerability affecting Commvault data protection software. Remote attackers can exploit improper path validation to access files outside intended directories on the file system. The flaw can be chained to achieve remote code execution on affected installations. Commvault published security advisory CV_2025_08_2 addressing the issue. The vulnerability is tracked under CWE-36: Absolute Path Traversal and carries a network attack vector requiring low privileges.

Critical Impact

Authenticated remote attackers can traverse the file system, write arbitrary files, and execute code on Commvault servers, threatening backup integrity and broader enterprise data.

Affected Products

• Commvault Commvault (see vendor advisory for affected versions)
• Deployments matching CPE cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*
• On-premises Commvault installations exposed to authenticated network access

Discovery Timeline

• 2025-08-20 - CVE-2025-57790 published to NVD
• 2025-09-10 - Last updated in NVD database

Technical Details for CVE-2025-57790

Vulnerability Analysis

The vulnerability is a path traversal weakness in Commvault that fails to canonicalize or restrict file paths supplied through network-facing functionality. An authenticated attacker can submit crafted path segments that escape the intended directory and reference arbitrary file system locations. Because Commvault services run with elevated privileges to perform backup and restore operations, file write primitives reachable through the flaw translate directly into remote code execution. The Commvault advisory CV_2025_08_2 confirms the chain from traversal to code execution. The EPSS probability of 46.09% (97.7 percentile) reflects elevated attacker interest relative to most CVEs.

Root Cause

The root cause is improper sanitization of path components within a request handler that resolves file system locations. The implementation does not enforce a canonical base directory or reject absolute paths and parent directory references, matching the CWE-36 pattern of absolute path traversal.

Attack Vector

Exploitation occurs over the network against an exposed Commvault service. The attacker must hold low-level credentials but does not require user interaction. After authenticating, the attacker submits requests containing traversal sequences to read or write files outside the intended directory. Writing a file to a location processed by the Commvault runtime, such as a script directory or auto-loaded module path, yields code execution under the service account.

No public proof-of-concept code has been verified at the time of writing. See the Commvault Security Advisory CV_2025_08_2 for vendor-supplied technical details.

Detection Methods for CVE-2025-57790

Indicators of Compromise

• Web or API request logs containing ../, ..\, URL-encoded traversal sequences (%2e%2e%2f), or absolute paths in parameters handled by Commvault endpoints
• Unexpected files written under Commvault installation directories, particularly executable, script, or configuration paths
• New or modified scheduled tasks, services, or persistence artifacts on Commvault servers
• Outbound connections from Commvault service accounts to unfamiliar destinations

Detection Strategies

• Inspect Commvault application and access logs for path parameters containing traversal tokens or absolute references outside the expected directory tree
• Correlate authenticated Commvault sessions with subsequent file system modifications under service binary or content paths
• Alert on child processes spawned by Commvault service accounts that are not part of normal backup operations

Monitoring Recommendations

• Forward Commvault server logs, Windows event logs, and Linux audit logs to a centralized SIEM for correlation
• Monitor file integrity on Commvault binary, script, and configuration directories
• Track authentication events on Commvault accounts and flag low-privilege accounts performing administrative-equivalent actions

How to Mitigate CVE-2025-57790

Immediate Actions Required

• Apply the fixes listed in Commvault Security Advisory CV_2025_08_2 to all Commvault instances
• Restrict network access to Commvault management interfaces to trusted administrative networks only
• Rotate credentials for Commvault accounts and review audit logs for unauthorized access since August 2025
• Inventory Commvault servers and prioritize internet-exposed or DMZ-resident systems for remediation

Patch Information

Commvault has published remediation guidance in advisory CV_2025_08_2. Administrators should consult the official advisory for the list of fixed builds and upgrade procedures applicable to their deployment.

Workarounds

• Place Commvault management endpoints behind a VPN or jump host to eliminate direct network exposure
• Enforce least-privilege access and disable unused Commvault user accounts to reduce the authenticated attack surface
• Apply network segmentation so backup infrastructure cannot be reached from general user subnets
• Enable multi-factor authentication on all Commvault administrative and operator accounts

# Configuration example: restrict Commvault management port access at the host firewall
# Replace 10.0.0.0/24 with your administrative network and adjust the port to your deployment
iptables -A INPUT -p tcp --dport 81 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 81 -j DROP