CVE-2026-76353: The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize ../ sequences that can resolve to a location that is outside of that directory. in Splunk Splunk Enterprise

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 contain a path traversal vulnerability (CVE-2026-76353) where external input used to construct file paths is not properly sanitized, allowing '../' sequences to escape the intended restricted directory. This flaw enables users lacking admin or power roles to submit malicious knowledge bundle deltas that delete arbitrary files on the cluster manager. The root cause is insufficient path restriction during knowledge bundle delta processing and lack of enforcement of authorization boundaries on the endpoint.

An attacker with limited privileges (not admin or power roles) can delete arbitrary files accessible to the Splunk Enterprise cluster manager. This can compromise system integrity and cause service disruption. There is no confidentiality impact reported. The CVSS score is 5.4 (medium severity) reflecting limited privileges required and impact on integrity and availability.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to these versions or later to remediate this vulnerability. No other mitigation or workaround is indicated in the provided data.