Service interruption via path-traversal file deletion

Path traversal in Splunk Web in Splunk Enterprise and Splunk Enterprise Cloud allows remote authenticated users to delete arbitrary files. The User Interface - Views configuration page accepts a crafted traversal payload and deletes attacker-selected files within a Splunk directory. Exploitation requires a low-privileged user without the admin or power role to trick an administrator into initiating the request in a browser, enabling a service interrupt.