Splunk Enterprise and Cloud Platform
CVE-2025-20320: Denial of Service (DoS) through “User Interface - Views“ configuration page in Splunk Enterprise
In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.107, 9.3.2408.117, and 9.2.2406.121, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the `User Interface - Views` configuration page that could potentially lead to a denial of service (DoS).The user could cause the DoS by exploiting a path traversal vulnerability that allows for deletion of arbitrary files within a Splunk directory.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Splunk Enterprise 9.4 | 9.4.3 or later |
| Splunk Enterprise 9.3 | 9.3.5 or later |
| Splunk Enterprise 9.2 | 9.2.7 or later |
| Splunk Enterprise 9.1 | 9.1.10 or later |
| Splunk Enterprise Cloud 9.3 | 9.3.2411.107 or later |
| Splunk Enterprise Cloud 9.3 | 9.3.2408.117 or later |
| Splunk Enterprise Cloud 9.2 | 9.2.2406.121 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.107, 9.3.2408.117, and 9.2.2406.121, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the `User Interface - Views` configuration page that could potentially lead to a denial of service (DoS).The user could cause the DoS by exploiting a path traversal vulnerability that allows for deletion of arbitrary files within a Splunk directory. The vulnerability requires the low-privileged user to phish the administrator-level victim by tricking them into initiating a request within their browser. The low-privileged user should not be able to exploit the vulnerability at will.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.