This vulnerability arises from improper handling and insufficient isolation of temporary files within the $SPLUNK_HOME/var/run/splunk/apptemp directory in affected Splunk Enterprise and Cloud Platform versions. A low-privileged user lacking admin or power roles can upload a malicious file to this directory, potentially leading to remote code execution. The issue affects versions prior to 10.2.1, 10.0.5, 9.4.10, and 9.3.11 in Splunk Enterprise and similarly dated versions in Splunk Cloud Platform. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, user interaction needed, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation could allow a low-privileged user to execute arbitrary code remotely on the affected system, compromising confidentiality, integrity, and availability of the application and potentially the underlying system. This could lead to unauthorized control over the Splunk instance and access to sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the $SPLUNK_HOME/var/run/splunk/apptemp directory to trusted users only and monitor for suspicious file uploads. Avoid granting unnecessary roles to users and follow any interim guidance provided by Splunk.