CVE-2025-20297: In Splunk Enterprise versions below 9.4.2, 9.3.4 and 9.2.6, and Splunk Cloud Platform versions below 9.3.2411.102, 9.3.2408.111 and 9.2.2406.118, a…

PriorityP337medium5.4CVSS 3.1

AVNACLPRLUIRSCCLILAN

EPSS

13.09%

95.9th percentile

In Splunk Enterprise versions below 9.4.2, 9.3.4 and 9.2.6, and Splunk Cloud Platform versions below 9.3.2411.102, 9.3.2408.111 and 9.2.2406.118, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the pdfgen/render REST endpoint that could result in execution of unauthorized JavaScript code in the browser of a user.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
splunk	splunk	>= 9.2.0 < 9.2.6	9.2.6
splunk	splunk	>= 9.3.0 < 9.3.4	9.3.4
splunk	splunk	>= 9.4.0 < 9.4.2	9.4.2
splunk	splunk_cloud_platform	>= 9.2.2406 < 9.2.2406.118	9.2.2406.118
splunk	splunk_cloud_platform	>= 9.3.2408 < 9.3.2408.111	9.3.2408.111
splunk	splunk_cloud_platform	>= 9.3.2411 < 9.3.2411.102	9.3.2411.102
splunk	splunk_enterprise	>= 9.1 < 9.1.9	9.1.9
splunk	splunk_enterprise	>= 9.2 < 9.2.6	9.2.6
splunk	splunk_enterprise	>= 9.3 < 9.3.4	9.3.4
splunk	splunk_enterprise	>= 9.4 < 9.4.2	9.4.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.