Cross-Site Scripting Vulnerability in Report Builder Component of WebConsole by Commvault

CVE-2025-12776

What is CVE-2025-12776?

The Report Builder component of the WebConsole from Commvault is vulnerable to a Cross-Site Scripting (XSS) attack due to improper handling of user input. This weakness allows malicious scripts to be injected and run when reports are modified by users with edit permissions. Although the scripts are not executed in reports viewed by end users, the risk remains significant for systems still utilizing the WebConsole, which is now end of life and no longer maintained. It is crucial to avoid deploying this package in production environments unless in a fully isolated network, as it may contain unpatched security flaws that could compromise sensitive data.

References