The CVFS component has an XML external entity reference handling issue that can cause the system to resolve external entities contained in crafted XML data, potentially exposing internal files or sensitive information. This flaw provides an attacker with the ability to read data that should remain confidential. The weakness follows the pattern of CWE‑611. The attack vector is not explicitly described in the advisory; it is inferred that an attacker must supply XML to a CVFS endpoint, which could be through configuration, APIs, or other XML‑processing interfaces.

Commvault Cloud and Commvault Grid(HSX) CVFS are affected. Version information was not provided.

A CVSS base score of 8.7 indicates high severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but the risk remains substantial due to the high CVSS. The vulnerability is not listed in the CISA KEV catalog, suggesting no current public exploitation, yet remediation is urgently advised. An attacker would need the ability to submit XML to CVFS, so an authenticated or publicly exposed endpoint would facilitate exploitation, leading to compromise of confidentiality.