CVE-2026-76337 PUBLISHED

Path Traversal through Splunk Web Static File Serving in Splunk Enterprise

Assigner: cisco
Reserved: 19.08.2026 Published: 19.08.2026 Updated: 19.08.2026

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could read JavaScript files outside the Splunk Web static directory. The vulnerability is possible because Splunk Web does not restrict static file requests to the configured static directory.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 5.3

Product Status

Vendor Splunk
Product Splunk Enterprise
Versions
  • affected from 10.4 to 10.4.2 (excl.)
  • affected from 10.2 to 10.2.6 (excl.)
  • affected from 10.0 to 10.0.9 (excl.)
  • affected from 9.4 to 9.4.14 (excl.)

Workarounds

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

Solutions

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14, or higher.

References

Problem Types

  • The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. cwe