Loading vulnerability…
Authenticated RCE in Splunk Enterprise and Splunk Cloud Platform via unauthorized file upload
CVE-2025-20229 is a remote code execution vulnerability in Splunk Enterprise and Splunk Cloud Platform caused by missing authorization checks on file upload handling. A low-privileged authenticated user who does not have the Splunk "admin" or "power" roles can upload a crafted file into the temporary application directory used by Splunk and leverage that upload path to achieve code execution. The flaw stems from insufficient authorization validation around access to the temporary application upload area, allowing users below the intended privilege boundary to place attacker-controlled content where it can subsequently be processed or executed by Splunk.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated low-privileged user to escalate from limited application access to remote code execution on the affected Splunk instance. This can enable full compromise of the Splunk service context, execution of arbitrary commands, deployment of additional payloads, access to data available to the service, and potential follow-on actions such as persistence or lateral movement depending on the host configuration and service privileges.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting access to Splunk to only trusted users, minimizing the number of low-privileged accounts, and closely monitoring for abuse of application upload functionality and unexpected execution activity associated with temporary application handling. No complete mitigation equivalent to patching is clearly established in the available information.
Patch, then assume compromise.
Upgrade to a fixed release. Reported fixed versions include Splunk Enterprise 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform 9.3.2408.104, 9.2.2406.108, 9.2.2403.114, 9.1.2312.208, and 9.1.2308.214. Apply the vendor security updates across all affected release trains.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.