EUVD-2026-44736
GHSA-237q-84h8-x5r9
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable install workflow (AV:N/AC:L) but requires admin-level edit_local_apps+install_apps capabilities (PR:H); primary impact is integrity/availability via config overwrite, with confidentiality only indirect (C:L).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
3DescriptionCVE.org
In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, and 10.1.2507.24, a user who holds a role that contains the edit_local_apps and install_apps capabilities could cause a legitimate app installation to write files outside the intended app directory, into $SPLUNK_HOME/etc/ and its subdirectories.<br><br>The vulnerability is caused by a path traversal in the app installation workflow, which does not restrict the installation path to the intended app directory.
AnalysisAI
Arbitrary file write in Splunk Enterprise (versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, 9.3.14) and Splunk Cloud Platform lets a privileged user with the edit_local_apps and install_apps capabilities abuse the app-installation workflow to write files outside the target app directory into $SPLUNK_HOME/etc/ and its subdirectories. The flaw is a path traversal (CWE-22) that can be leveraged to overwrite Splunk configuration and system files, yielding high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
Splunk apps are packaged bundles installed under $SPLUNK_HOME/etc/apps/, and installation is gated by the install_apps and edit_local_apps role capabilities. The vulnerability is a CWE-22 path traversal in the app installation routine: the code that unpacks/places an app's files does not constrain the destination to the intended per-app directory, so crafted path components in the package cause files to be written elsewhere under $SPLUNK_HOME/etc/. Because $SPLUNK_HOME/etc/ holds server-wide configuration (server.conf, authentication/authorization config, scripted inputs, and other apps), the ability to write there escalates a routine install operation into tampering with the Splunk runtime configuration. Affected CPEs are cpe:2.3:a:splunk:splunk_enterprise and cpe:2.3:a:splunk:splunk_cloud_platform.
RemediationAI
Vendor-released patch: upgrade Splunk Enterprise to 10.4.1, 10.2.5, 10.0.8, 9.4.13, or 9.3.14 (or later) per the fixed branch you run; Splunk Cloud Platform is remediated by Splunk to 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, or 10.1.2507.24 or later. See the advisory at https://advisory.splunk.com/advisories/SVD-2026-0703. As a compensating control until patched, tightly restrict the edit_local_apps and install_apps capabilities - remove them from any non-administrator or broadly-delegated roles so only fully trusted operators can install apps, since these are the exact prerequisites for exploitation (trade-off: users who legitimately self-manage apps lose that ability). Additionally, only install apps from trusted, vetted sources and validate package contents, and monitor $SPLUNK_HOME/etc/ for unexpected file writes outside etc/apps/ following install operations as a detection measure.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re
A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an atta
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today