Skip to content
OpenAdvisories
High · 7.5 Scanner template Public exploit CVE-2024-36991 EUVD-2024-36378GHSA-fg59-j242-rcj9

Path Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on Windows

Published Jul 1, 2024 · Updated Feb 28, 2025 · Assigned by Splunk

Vendor: Splunk Product: Splunk Enterprise

Description

In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.

Affected products

VendorProductAffectedFixed
Splunk Splunk Enterprise 9.2 – < 9.2.2, 9.1 – < 9.1.5, 9.0 – < 9.0.10 9.2.2

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 10 repositories

  • bigb0x/CVE-2024-36991 ★ 126 · Jul 6, 2024

    POC for CVE-2024-36991: This exploit will attempt to read Splunk /etc/passwd file.

  • jaytiwari05/CVE-2024-36991 ★ 9 · Mar 30, 2025

    Critical Splunk Vulnerability CVE-2024-36991: Patch Now to Prevent Arbitrary File Reads

  • Mr-xn/CVE-2024-36991 ★ 9 · Jul 6, 2024

    Path Traversal On The "/Modules/Messaging/" Endpoint In Splunk Enterprise On Windows

  • gunzf0x/CVE-2024-36991 ★ 4 · Mar 31, 2025

    Proof of Concept for CVE-2024-36991. Path traversal for Splunk versions below 9.2.2, 9.1.5, and 9.0.10 for Windows which allows arbitrary file read.

  • 0xFZin/CVE-2024-36991 ★ 3 · Jul 6, 2025

    Exploit for CVE-2024-36991 , written by me, enumerates a handfull of things, not all, cause not needed.

  • Cappricio-Securities/CVE-2024-36991 ★ 3 · Jul 10, 2024

    Path traversal vulnerability in Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10 that allows reading sensitive files.

  • TheStingR/CVE-2024-36991-Tool ★ 2 · Mar 30, 2025

    This binary POC automates the exploitation of CVE-2024-36991 by sending crafted curl requests to a vulnerable Splunk instance. It retrieves sensitive files and saves them locally for further analysis…

  • th3gokul/CVE-2024-36991 ★ 2 · Jul 6, 2024

    CVE-2024-36991: Path traversal that affects Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10.

  • jhurtadomi/CVE-2024-36991-Splunk ★ 0 · Mar 21, 2026

    Path traversal exploit for Splunk Enterprise on Windows (CVE-2024-36991) — interactive file harvester

  • sardine-web/CVE-2024-36991 ★ 0 · Jul 6, 2024

    Path traversal vulnerability in Splunk Enterprise on Windows

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Advisories 2

References