Fire In The Hole, We’re Breaching The Vault - Commvault Remote Code Execution (CVE-2025-34028)

try { InputStream in = response.getEntity().getContent(); <---- [2] String confPath = BASE_PATH + File.separator + "Apache" + File.separator + "conf" + File.separator + "ccPackages" + File.separator; String distCCPath = BASE_PATH + File.separator + "AdminConsole" + File.separator + "dist-cc-sps" + File.separator; File confDirectory = this.createDirectory(confPath + servicePack); <---- [3] String var10002 = confDirectory.getAbsolutePath(); File versionFile = new File(var10002 + File.separator + "version.txt"); FileUtils.writeStringToFile(versionFile, version, StandardCharsets.UTF_8, false); this.createDirectory(distCCPath); BufferedInputStream bis = new BufferedInputStream(in); <---- [4] try { FileOutputStream fos = new FileOutputStream(new File(confDirectory, "dist-cc.zip")); <---- [5]…