Vulnerability · Published Jul 15, 2026 · Assigned by cisco
CVE-2026-20297Path Traversal through 'explicit_appname' in the App Install REST Endpoint in Splunk Enterprise
High 7.2
In plain English
A high-severity path traversal in Splunk Cloud Platform from Splunk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Official description
In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, and 10.1.2507.24, a user who holds a role that contains the `edit_local_apps` and `install_apps` capabilities could cause a legitimate app installation to write files outside the intended app directory, into `$SPLUNK_HOME/etc/` and its subdirectories.<br><br>The vulnerability is caused by a path traversal in the app installation workflow, which does not restrict the installation path to the intended app directory.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Splunk | Splunk Enterprise | 10.4 – before 10.4.110.2 – before 10.2.510.0 – before 10.0.89.4 – before 9.4.139.3 – before 9.3.14 |
| Splunk | Splunk Cloud Platform | 10.5.2605 – before 10.5.2605.010.4.2604 – before 10.4.2604.610.2.2510 – before 10.2.2510.1810.1.2507 – before 10.1.2507.24 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H