HyperScale contains a file path traversal flaw that permits attackers to retrieve arbitrary files from the system. By manipulating the path parameters sent to the MediaAgent service, malicious actors can read sensitive configuration files or user data, exposing critical information that may aid further attacks. The vulnerability directly leads to information disclosure but does not grant code execution or denial of service.

The affected product is the CommVault Cloud HyperScale MediaAgents component. The advisory does not specify impacted versions, so all deployments that run the HyperScale MediaAgents should be checked for the presence of this flaw and should reference CommVault's recommended maintenance release for the fix.

The flaw has a CVSS base score of 7.1, indicating a high impact level for affected systems. The EPSS score is currently unavailable, but the advisory states it is not listed in KEV, therefore no known exploit activity has been reported yet. The likely attack vector is network-based, where remote actors exploit exposed MediaAgent endpoints by sending crafted HTTP requests. Until a patch is fully deployed the risk remains significant, especially for environments that expose HyperScale services to untrusted networks.