The vulnerability permits a user lacking the admin or power role in Splunk Enterprise to move files that the Splunk service can read into a lookup the user controls via the lookup configuration REST API. Because the API does not resolve the full path before verifying that it remains inside the allowed staging area, an attacker can choose arbitrary source paths, enabling the creation of lookups that reference sensitive data. This path traversal flaw leads to unauthorized access to all data handled by the lookup and permits a user to disrupt the integrity and availability of data on the search head. The weakness is a classic example of CWE‑26.

Splunk Enterprise versions earlier than 10.4.2, 10.2.6, 10.0.9, and 9.4.14 are impacted.

The CVSS score of 8.8 classifies the flaw as high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation yet. An attacker must have a non‑admin Splunk role that can use the REST API, but many internal users possess such roles. The path traversal can be triggered from any machine that can reach the lookup configuration endpoint, so the attack vector is likely local or LAN‑based. Given the high severity score and the potential to disrupt search head operation, the risk to organizations using the affected Splunk versions is significant.