This vulnerability in Commvault Cloud's DataCube component allows for path traversal due to improper limitation of a pathname to a restricted directory. The issue affects versions 11.36.0, 11.40.0, 11.44.0, and 11.46.0. The CVSS 4.0 base score is 8.5, indicating high severity, with local attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor advises upgrading to a maintenance release that updates the Content Extractor and Index Store to resolve the issue. No official patch or remediation level is explicitly stated, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker with limited privileges and local access to perform path traversal, potentially bypassing security feature enforcement and accessing or modifying restricted files. The vulnerability has a high impact on confidentiality, integrity, and availability as per the CVSS vector.

The vendor recommends upgrading to the resolved maintenance release that updates the Content Extractor and Index Store components. Since no official patch or remediation level is explicitly stated, users should monitor vendor advisories for the specific fixed versions and apply updates accordingly. No known exploits are reported in the wild, reducing immediate urgency but patching is advised to mitigate risk.