CVE-2026-76317: The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize /dir/../filename sequences that can resolve to a location that is outside of that directory. in Splunk Splunk Enterprise

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 contain a path traversal vulnerability due to improper neutralization of /dir/../filename sequences in the lookup configuration endpoint. This flaw allows users without admin or power roles to move files accessible by the Splunk Enterprise service into user-controlled lookups, enabling unauthorized data access and potential disruption of system integrity and availability on the search head. The vulnerability arises because the endpoint does not resolve lookup source paths before verifying that they remain within the allowed lookup staging area.

An attacker with a Splunk user account lacking admin or power roles can exploit this vulnerability to access sensitive data by moving readable files into lookups they control. This can lead to unauthorized data disclosure and may affect the integrity and availability of the Splunk search head system.

Splunk has released fixes in versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to these or later versions to remediate the vulnerability. No other mitigation guidance is provided in the advisory; patching is the recommended action.