CVE-2025-20229

In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.104, 9.2.2406.108, 9.2.2403.114, and 9.1.2312.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remote Code Execution (RCE) through a file upload to the "$SPLUNK_HOME/var/run/splunk/apptemp" directory due to missing authorization checks.

• splunk splunk (>= 9.1.0 < 9.1.8) • splunk splunk (>= 9.2.0 < 9.2.5) • splunk splunk (>= 9.3.0 < 9.3.3) • splunk splunk 9.4.0 • splunk splunk cloud platform (>= 9.1.2312 < 9.1.2312.208) • splunk splunk cloud platform (>= 9.2.2403 < 9.2.2403.114) • splunk splunk cloud platform (>= 9.2.2406.100 < 9.2.2406.108) • splunk splunk cloud platform (>= 9.3.2408.100 < 9.3.2408.104)