First Pre-Auth RCE Chain – Works everywhere
WT-2025-0050 – Authentication bypass via argument injection in the qlogin QCommand, allowing us to generate a valid API token for the localadmin user.
documentation.commvault.com/…
WT-2025-0049 – Post-auth RCE via absolute path traversal in QCommand output writer, allowing a JSP webshell to be dropped straight into the webroot.
documentation.commvault.com/…
Second Pre-Auth RCE Chain – Works if the built-in admin password hasn’t been changed since installation
WT-2025-0047 – Authentication bypass allowing us to leak the password of the low-privileged _ _PublicSharingUser_.
documentation.commvault.com/…
WT-2025-0048 – Privilege escalation via hard-coded encryption key, allowing us to decrypt the built-in admin password if it’s stored in encrypted form.
documentation.commvault.com/…
WT-2025-0049 – The same post-auth RCE from the first chain to finish with full remote code execution.
documentation.commvault.com/…