Splunk Enterprise CVE-2026-20297

Exploitation requires an authenticated Splunk user whose assigned role grants BOTH the edit_local_apps AND install_apps capabilities, and the attacker must go through the app installation workflow supplying a crafted app whose paths traverse out of the intended app directory. Limiting factors: these capabilities are administrative/trusted by default (CVSS PR:H), so an unprivileged or default-read-only user cannot exploit this; no user interaction by a victim is needed (UI:N) and it is reachable over the network management interface (AV:N) at low complexity (AC:L). The realistic exposure is confined to environments that delegate app-install capabilities to non-admin roles or where a privileged account is compromised.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 High) frames this as a network-reachable, low-complexity attack with full triple impact but requiring high privileges - the attacker must already hold a role granting edit_local_apps and install_apps, capabilities normally reserved for administrators or trusted app managers. That PR:H requirement is the dominant limiting factor and pulls real-world urgency below the raw High score for well-governed environments; the practical risk is highest where those capabilities are delegated to non-admin or lightly-trusted roles, or in multi-tenant/managed deployments. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active or automated exploitation - this reads as a privilege-boundary/integrity hardening fix rather than an imminent mass-exploitation threat. The C:H rating is somewhat generous for a file-write primitive; the concrete danger is I:H/A:H via config overwrite, with confidentiality following only if the attacker leverages the write to exfiltrate or plant read access.

A user assigned a role that includes edit_local_apps and install_apps crafts a malicious Splunk app package containing traversal path components, then uploads and installs it through the normal app-installation workflow. During install, files are written outside the app's directory into $SPLUNK_HOME/etc/, overwriting server-wide configuration to tamper with Splunk's behavior or plant a foothold. Low attack complexity means a knowledgeable insider or holder of compromised privileged credentials can perform this reliably; no public POC is currently identified.