Remote Command Execution Vulnerability in Splunk Enterprise by Splunk

CVE-2025-20319

What is CVE-2025-20319?

In Splunk Enterprise, prior to version 9.4.3, a significant vulnerability exists that enables a user with specific high-privilege capabilities, such as 'edit_scripted' and 'list_inputs', to carry out remote command execution. This flaw arises from inadequate sanitization of user input within scripted input files, potentially allowing malicious actors to execute arbitrary commands on the server. For further details on managing roles and capabilities within Splunk, refer to the official documentation.

References