CVE-2026-77104: Commvault Path Traversal Vulnerability

CVE-2026-77104 Overview

Commvault disclosed a path traversal vulnerability in CommServe that allows remote attackers to access information outside of intended directories. The flaw is tracked as CVE-2026-77104 and is classified under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. Commvault issued guidance directing customers to upgrade to a resolved maintenance release of CommServe.

The issue affects CommServe, the central management component of the Commvault data protection platform. Successful exploitation exposes confidential files on the host, undermining the confidentiality guarantees expected of a backup control server.

Critical Impact
Unauthenticated network attackers can traverse the CommServe file system to retrieve sensitive data, including configuration and credential artifacts stored on the backup management server.

Affected Products

Commvault CommServe (see vendor advisory for fixed maintenance releases)
Deployments running on Microsoft Windows
Deployments running on Linux

Discovery Timeline

2026-09-08 - CVE-2026-77104 published to the National Vulnerability Database
2026-09-09 - Entry last modified in NVD
Vendor advisory - Commvault published Security Advisory CV_2026_08_6

Technical Details for CVE-2026-77104

Vulnerability Analysis

CommServe fails to properly restrict pathname resolution when handling attacker-controlled input. An attacker can craft requests containing directory traversal sequences to read files outside the intended base directory. Because CommServe is the orchestration hub for Commvault backup operations, exposed files can include configuration data, logs, and other operational artifacts that assist follow-on attacks.

The vulnerability requires no authentication and is exploitable over the network. Commvault classifies the impact as information disclosure only; integrity and availability of the CommServe service are not affected directly by this flaw. However, credentials or tokens harvested through disclosed files may enable subsequent attacks against backup infrastructure and connected systems.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory ([CWE-22]). CommServe accepts input that resolves into file paths without adequately canonicalizing the path or validating that the resolved location remains within an allowed directory. Traversal sequences such as ../ bypass the intended containment.

Attack Vector

An unauthenticated remote attacker sends a specially crafted request to an exposed CommServe interface. The request includes traversal sequences targeting files outside the web-accessible directory. The service returns file contents to the attacker, disclosing information that should not be accessible over the network. Exploitation complexity is elevated, according to the CVSS assessment, but no privileges or user interaction are required.

No public proof-of-concept exploit or in-the-wild exploitation has been reported at the time of publication. See the Commvault Security Advisory CV_2026_08_6 for vendor technical details.

Detection Methods for CVE-2026-77104

Indicators of Compromise

HTTP or API requests to CommServe endpoints containing ../, ..\, URL-encoded (%2e%2e%2f), or double-encoded traversal sequences
CommServe access to files outside expected web directories, such as configuration files, credential stores, or log files
Unusual outbound responses from CommServe carrying file contents to untrusted source IPs
Repeated 200-response file retrievals from a single source enumerating paths

Detection Strategies

Inspect CommServe web server and application logs for path traversal patterns and abnormal file read patterns
Apply web application firewall (WAF) rules targeting directory traversal payloads on requests reaching CommServe
Correlate CommServe request logs with file system audit events to identify reads of sensitive files initiated from web-facing services
Alert on any unauthenticated access to CommServe management endpoints from untrusted network segments

Monitoring Recommendations

Enable verbose access logging on the CommServe web tier and forward logs to a central analytics platform
Monitor egress traffic from the CommServe host for anomalous transfer sizes tied to HTTP responses
Track file system reads of secrets, keystores, and configuration files by CommServe service accounts
Baseline normal CommServe request patterns and alert on deviations, especially requests containing encoded path characters

How to Mitigate CVE-2026-77104

Immediate Actions Required

Upgrade CommServe to the resolved maintenance release identified in the vendor advisory
Restrict network access to CommServe management interfaces to trusted administrative networks only
Review CommServe logs for prior evidence of traversal attempts or unauthorized file reads
Rotate credentials, API keys, and secrets stored on or accessible from the CommServe host if compromise is suspected

Patch Information

Commvault has released fixed maintenance versions for CommServe. Refer to Commvault Security Advisory CV_2026_08_6 for the specific fixed release numbers and upgrade procedures. Apply the update through the standard Commvault maintenance release process for both Windows and Linux deployments.

Workarounds

Place CommServe behind a reverse proxy or WAF that filters directory traversal payloads
Enforce network segmentation to limit exposure of CommServe to only authorized administrative hosts
Disable or firewall any unused CommServe web-facing endpoints until patching is complete
Restrict service account permissions on the CommServe host so that readable files are limited to those required for operation

bash

# Example: block traversal patterns at an nginx reverse proxy in front of CommServe
location / {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)") {
        return 403;
    }
    proxy_pass https://commserve.internal;
}