CVE-2026-76317: The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize /dir/../filename sequences that can resolve to a location that is outside of that directory. in Splunk Splunk Enterprise

CVE-2026-76317 affects Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows a user lacking admin or power roles to move files readable by the Splunk Enterprise user into a lookup controlled by that user. The vulnerability exists due to improper path resolution in the lookup configuration endpoint, which fails to verify that lookup source paths remain within the allowed staging area. This flaw can lead to unauthorized access to data and compromise system integrity and availability on the search head.

An attacker with limited privileges can access sensitive data by moving readable files into a user-controlled lookup, potentially leading to confidentiality, integrity, and availability impacts on the Splunk Enterprise search head. The CVSS score of 8.8 reflects high severity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and monitor for unusual lookup configuration changes. Follow Splunk documentation on managing roles and lookups to minimize exposure.