Executive brief
Splunk Enterprise is a widely-used data analytics and security monitoring platform. An unauthenticated user can exploit a path traversal vulnerability in the static file serving mechanism to read arbitrary JavaScript files outside the intended web directory. This could expose sensitive configuration data, authentication tokens, or other confidential information stored in static files.
Technical details
This is a path traversal vulnerability (CWE-22) in Splunk Web's static file request handler. The root cause is insufficient input validation: Splunk Web does not properly restrict static file requests to the configured static directory, allowing an attacker to use path traversal sequences (e.g., ../) to access files outside the intended scope. The vulnerability is unauthenticated and exploitable over the network via standard HTTP requests. An attacker can read arbitrary JavaScript files and potentially extract sensitive information. Patches are available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14 or higher.
Affected products
- Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14
Timeline
- 2026-08-19: disclosed
- 2026-08-19: patched: Fixed in Enterprise 10.4.2, 10.2.6, 10.0.9, and 9.4.14