CVE-2025-20369: Extensible Markup Language (XML) External Entity Injection (XXE) through Dashboard label field on Splunk Enterprise

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-01 · updated 2026-10-18
Weakness: CWE-776

Description

In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privilege user that does not hold the "admin" or "power" Splunk roles could perform an extensible markup language (XML) external entity (XXE) injection through the dashboard tab label field. The XXE injection has the potential to cause denial of service (DoS) attacks.

Affected products

Splunk Enterprise: from 9.2.0 before 9.2.8; from 9.3.0 before 9.3.6; from 9.4.0 before 9.4.4 — fixed in 9.2.8, 9.3.6, 9.4.4
Splunk Cloud Platform: from 9.2.2406 before 9.2.2406.123; from 9.3.2408 before 9.3.2408.118; from 9.3.2411 before 9.3.2411.108 — fixed in 9.2.2406.123, 9.3.2408.118, 9.3.2411.108

How to fix

Upgrade to a fixed version: Splunk Enterprise 9.2.8, 9.3.6, 9.4.4; Splunk Cloud Platform 9.2.2406.123, 9.3.2408.118, 9.3.2411.108. Check the vendor advisory for mitigations.

References

https://advisory.splunk.com/advisories/SVD-2025-1004

Get alerted when CVE-2025-20369 or the next vulnerability affects your stack