An attacker with a low‑privilege account that lacks admin or power roles can exploit a path traversal flaw in Splunk Enterprise and Splunk Cloud Platform to inject a malicious SPL query into a custom data model. By doing so the SPL safeguards around risky commands are bypassed, allowing the attacker to execute commands that normally would be restricted. This could lead to unauthorized manipulation of data or further escalation of privileges.

The vulnerability affects Splunk and its Cloud Platform. Splunk Enterprise releases older than version 10.2.0, 10.0.3, 9.4.5, 9.3.7, and 9.2.9 are susceptible, as are Splunk Cloud Platform releases older than 10.1.2507.0, 10.0.2503.9, 9.3.2411.112, and 9.3.2408.122. All other enterprise and cloud versions are considered secure.

The CVSS score of 3.5 classifies the flaw as low severity, and the EPSS score of less than 1% indicates that exploitation is unlikely at current exposure levels. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access or a low‑privileged user’s ability to create data models, and it proceeds via a path‑traversal exploitation of the preloaded model loader. The path traversal and SPL injection jointly enable the bypass of command safeguards, providing the attacker a potential vector to execute risky commands and possibly gain elevated privileges.