Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could read JavaScript files outside the Splunk Web static directory. The vulnerability is possible because Splunk Web does not restrict static file requests to the configured static directory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-19T22:17:18.233Z",
  "pubdate": "2026-08-19T22:17:18.233Z",
  "executiveSummary": "Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 contain an unauthenticated path traversal vulnerability affecting the Splunk Web component.\nThe security flaw arises from an absence of adequate path restriction controls for static file requests, allowing remote, unauthenticated attackers to traverse the file system and read arbitrary JavaScript files located outside the designated Splunk Web static directory.\nThis unauthorized disclosure of system files can expose sensitive application logic, internal scripts, or configuration data embedded within JavaScript assets, thereby increasing the overall attack surface and risking further compromise.\nExploitation of this vulnerability requires network access to the Splunk Web interface but does not require any prior authentication or privileged access credentials.\nOrganizations operating vulnerable deployments face significant risk if exposed to untrusted networks, making timely remediation imperative.",
  "technicalDetails": "The root cause of this vulnerability is improper input validation and insufficient boundary enforcement within the Splunk Web request handling mechanism for static resources.\nSpecifically, Splunk Web fails to properly sanitize and restrict static file requests to the pre-configured static directory, allowing directory traversal sequences or absolute references to bypass intended access boundaries.\nThe vulnerable component is the static file serving module within Splunk Web.\nAffected products and versions include Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nThe attack flow proceeds as follows: an unauthenticated remote attacker crafts an HTTP request targeting the Splunk Web interface, appending path traversal sequences designed to navigate outside the authorized static file root.\nBecause the application fails to validate whether the requested resource resides within the permitted directory, the underlying file system processes the request and returns the contents of the targeted JavaScript file.\nNo authentication or authorization checks are enforced for these specific static file requests, allowing any external entity with network reachability to the Splunk Web port to execute the retrieval.\nNetwork exposure is inherent to any Splunk Enterprise instance where the Splunk Web interface is accessible to users or attackers over the network.\nPost-exploitation impact includes the unauthorized reading of JavaScript files stored outside the static directory, which may reveal internal application routing, sensitive functional logic, or other proprietary data useful for planning subsequent attacks against the deployment."
}