high8.0
CVE-2025-20229
In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.104, 9.2.2406.108, 9.2.2403.114, and 9.1.2312.20…
Impact
In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.104, 9.2.2406.108, 9.2.2403.114, and 9.1.2312.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remote Code Execution (RCE) through a file upload to the "$SPLUNK_HOME/var/run/splunk/apptemp" directory due to missing authorization checks.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Splunk | Splunk | from 9.1.0 before 9.1.8 from 9.2.0 before 9.2.5 from 9.3.0 before 9.3.3 Version 9.4.0 |
| Splunk | Splunk Cloud Platform | from 9.1.2312 before 9.1.2312.208 from 9.2.2403 before 9.2.2403.114 from 9.2.2406.100 before 9.2.2406.108 from 9.3.2408.100 before 9.3.2408.104 |