CVE-2026-20297

Path Traversal through 'explicit_appname' in the App Install REST Endpoint in Splunk Enterprise

State: Published
Severity: 7.2 High
Published: Jul 15, 2026
Updated: Jul 16, 2026
Reserved: Oct 8, 2025

Description

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, and 10.1.2507.24, a user who holds a role that contains the `edit_local_apps` and `install_apps` capabilities could cause a legitimate app installation to write files outside the intended app directory, into `$SPLUNK_HOME/etc/` and its subdirectories.<br><br>The vulnerability is caused by a path traversal in the app installation workflow, which does not restrict the installation path to the intended app directory.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	cisco

Weaknesses

CWE-22 The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Affected Products

Product	Versions
Splunk EnterpriseSplunk	10.4 to before 10.4.1Affected 10.2 to before 10.2.5Affected 10.0 to before 10.0.8Affected 9.4 to before 9.4.13Affected 9.3 to before 9.3.14Affected
Splunk Cloud PlatformSplunk	10.5.2605 to before 10.5.2605.0Affected 10.4.2604 to before 10.4.2604.6Affected 10.2.2510 to before 10.2.2510.18Affected 10.1.2507 to before 10.1.2507.24Affected

References

https://advisory.splunk.com/advisories/SVD-2026-0703

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.