CVE-2025-20320: splunk — Fix

Description

In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.107, 9.3.2408.117, and 9.2.2406.121, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the `User Interface - Views` configuration page that could potentially lead to a denial of service (DoS).The user could cause the DoS by exploiting a path traversal vulnerability that allows for deletion of arbitrary files within a Splunk directory. The vulnerability requires the low-privileged user to phish the administrator-level victim by tricking them into initiating a request within their browser. The low-privileged user should not be able to exploit the vulnerability at will.

Is your site exposed to CVE-2025-20320?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H

Weakness Type (CWE)

CWE-35 CWE-35

Affected Products

Vendor	Product	Versions
splunk	splunk	9.1.0 — 9.1.10
splunk	splunk	9.2.0 — 9.2.7
splunk	splunk	9.3.0 — 9.3.5
splunk	splunk	9.4.0 — 9.4.3
splunk	splunk_cloud_platform	9.2.2406 — 9.2.2406.121
splunk	splunk_cloud_platform	9.3.2408 — 9.3.2408.117
splunk	splunk_cloud_platform	9.3.2411 — 9.3.2411.107

References

Advisories & Patches

https://advisory.splunk.com/advisories/SVD-2025-0703

Frequently Asked Questions

What is CVE-2025-20320? +

In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.107, 9.3.2408.117, and 9.2.2406.121, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the `User Interface - Views` configuration page that could potentially lead to a denial of service (DoS).The user could cause the DoS by exploiting a path traversal vulnerability that allows for deletion of arbitrary files within a Splunk directory. The vulnerability requires the low-privileged user to phish the administrator-level victim by tricking them into initiating a request within their browser. The low-privileged user should not be able to exploit the vulnerability at will. It has a CVSS v3.1 base score of 6.3 (MEDIUM).

How severe is CVE-2025-20320? +

CVE-2025-20320 has a CVSS v3.1 score of 6.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-20320? +

CVE-2025-20320 affects products from splunk, specifically: splunk, splunk_cloud_platform. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-20320? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-11136

The default TCL Camera application exposes a provider vulnerable to path traversal vulnerability. Malicious application can supply malicious URI path …

CVE-2026-42274

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs rule …

CVE-2025-5598

Path Traversal vulnerability in WF Steuerungstechnik GmbH airleader MASTER allows Retrieve Embedded Sensitive Data.This issue affects airleader MASTER: 3.0046.

CVE-2025-53880

A Path Traversal vulnerability in the tftpsync/add and tftpsync/delete scripts allows a remote attacker on an adjacent network to write …

CVE-2025-0858

A vulnerability was discovered in the firmware builds up to 8.2.1.0820 in certain Poly devices. The firmware flaw does not …

CVE-2025-53417

DIAView (v4.2.0 and prior) - Directory Traversal Information Disclosure Vulnerability

CVE-2025-20320