CVE-2025-20298 Incorrect permission assignment on Universal Forwarder for Windows during new installation or upgrade
Incorrect directory permissions allow non-administrator users to access Splunk Universal Forwarder files, potentially leading to data exposure or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-20298?
CVE-2025-20298 is a high-severity vulnerability in Splunk Universal Forwarder, published on 2 Jun 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
In Universal Forwarder for Windows versions below 9.4.2, 9.3.4, 9.2.6, and 9.1.9, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Universal Forwarder for Windows Installation directory (by default, C:\Program Files\SplunkUniversalForwarder). This lets non-administrator users on the machine access the directory and all its contents.
Weakness: CWE-732
Which versions are affected by CVE-2025-20298?
It affects 1 product.
Products include Splunk Universal Forwarder.
How do I fix CVE-2025-20298?
No fix has been published for CVE-2025-20298 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-20298 being exploited?
There is no known exploitation of CVE-2025-20298 in the wild and no public exploit code.
Sources
Also known as GHSA-4q83-43xw-q63j.