CVE-2025-57790

Published Aug 20, 2025

Last updated a day ago

Commvault

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-57790 is a path traversal vulnerability in Commvault software before version 11.36.60. It allows a remote attacker to perform unauthorized file system access. By exploiting this vulnerability, an attacker can write a JavaServer Pages (JSP) webshell into the webroot, achieving remote code execution (RCE). This path traversal flaw can be combined with other vulnerabilities in Commvault to create RCE exploit chains. One chain involves CVE-2025-57791, an argument injection vulnerability, while another involves CVE-2025-57788 and CVE-2025-57789, which relate to information disclosure and privilege escalation, respectively.

Description: An issue was discovered in Commvault before 11.36.60. A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue. The vulnerability may lead to remote code execution.
Source: cve@mitre.org
NVD status: Analyzed
Products: commvault

Risk scores

CVSS 4.0

Type: Secondary
Base score: 8.7
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: HIGH

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

cve@mitre.org: CWE-36

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 1

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7ABD6584-4B5A-49F4-B2FD-B53B4ECAF0C5",
            "versionEndExcluding": "11.36.60"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.