File exposure via unresolved lookup paths

Path traversal in Splunk Enterprise before 10.4.2, 10.2.6, 10.0.9, and 9.4.14 allows remote authenticated users to read files via crafted lookup paths. The lookup configuration REST endpoint checks whether a supplied source path stays inside the lookup staging area before resolving the path, so traversal sequences can cause Splunk to move readable files into an attacker-controlled lookup. A user without the admin or power role can reach the flaw when able to manage a lookup, which exposes data readable by the Splunk service account and can also affect search-head integrity and availability.