CVE-2026-76337: The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. in Splunk Splunk Enterprise

Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14 contain a directory traversal vulnerability where external input is used to construct file pathnames without proper neutralization of special elements. This flaw allows unauthenticated users to access JavaScript files outside the configured static directory of Splunk Web, potentially exposing sensitive files.

An unauthenticated attacker can read JavaScript files outside the intended static directory, which may lead to information disclosure. The vulnerability does not allow modification or denial of service, and the CVSS score is 5.3 (medium severity). There are no known exploits in the wild.

Splunk has released fixed versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14 that address this vulnerability. Users should upgrade to these or later versions to remediate the issue. No additional mitigation steps are indicated.