Skip to content
CVE PROGRAM SOURCE RECORD7.2 High

CVE-2026-20297

Path Traversal through 'explicit_appname' in the App Install REST Endpoint in Splunk Enterprise

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
cisco

Description

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, and 10.1.2507.24, a user who holds a role that contains the `edit_local_apps` and `install_apps` capabilities could cause a legitimate app installation to write files outside the intended app directory, into `$SPLUNK_HOME/etc/` and its subdirectories.<br><br>The vulnerability is caused by a path traversal in the app installation workflow, which does not restrict the installation path to the intended app directory.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Splunk Splunk Enterprise

  • 10.4 to < 10.4.1affected
  • 10.2 to < 10.2.5affected
  • 10.0 to < 10.0.8affected
  • 9.4 to < 9.4.13affected
  • 9.3 to < 9.3.14affected

Splunk Splunk Cloud Platform

  • 10.5.2605 to < 10.5.2605.0affected
  • 10.4.2604 to < 10.4.2604.6affected
  • 10.2.2510 to < 10.2.2510.18affected
  • 10.1.2507 to < 10.1.2507.24affected

References