CVE-2026-76344: The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal ../ sequences that can resolve to a location that is outside of that directory. in Splunk Splunk Enterprise

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 contain a path traversal vulnerability (CVE-2026-76344) where non-admin and non-power role users can supply a crafted search identifier to a REST API endpoint. The software fails to properly neutralize multiple internal '../' sequences in the search identifier before using it to create a dispatch directory, allowing writing of dispatch metadata to arbitrary locations on the host filesystem. This can affect system integrity by enabling unauthorized file writes outside the intended directory.

An attacker with limited privileges (not holding admin or power roles) can write files to arbitrary locations on the host system, potentially affecting system integrity. The vulnerability does not impact confidentiality or availability but poses a high integrity risk due to unauthorized file writes.

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later, where this vulnerability is fixed. No other mitigation or temporary fix is indicated. Users should follow official Splunk documentation on role-based user access to ensure proper permissions are enforced.