CVE-2026-20297CWE-22

Path Traversal through 'explicit_appname' in the App Install REST Endpoint in Splunk Enterprise

High · published July 15, 2026

CVSS v3.1
7.2
EPSS
1%
Percentile
46.5
In the wild
Unconfirmed
What it is

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, and 10.1.2507.24, a user who holds a role that contains the `edit_local_apps` and `install_apps` capabilities could cause a legitimate app installation to write files outside the intended app directory, into `$SPLUNK_HOME/etc/` and its subdirectories.<br><br>The vulnerability is caused by a path traversal in the app installation workflow, which does not restrict the installation path to the intended app directory.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00571 · 46.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-07-15T17:18Z
EPSS history
Timeline
  • 15 JUL 17:18Z
    Path Traversal through 'explicit_appname' in the App Install REST Endpoint in Splunk Enterprise
    cvelistv5