EUVD-2026-62923
GHSA-2qxp-mv5r-x6p7
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
App-install privilege is explicitly required (PR:H); arbitrary file write yields integrity and availability impact with no confidentiality disclosure (C:N/I:H/A:H); scope unchanged as impact is confined to the SOAR host (S:U).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
In Splunk SOAR versions below 8.6.0, a user with app-install privileges could use path traversal during app installation to write files outside the intended temporary directory. The vulnerability is a path traversal in the archive extraction routine, which does not validate that extracted file paths stay within the intended destination directory. For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) and Add and configure apps and assets to provide actions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-apps-and-assets/add-and-configure-apps-and-assets-to-provide-actions-in-splunk-soar-on-premises) in the Splunk documentation.
AnalysisAI
Path traversal during app installation in Splunk SOAR On-premises below version 8.6.0 allows an authenticated user holding app-install privileges to write files outside the intended temporary extraction directory. The archive extraction routine fails to validate that file paths within an uploaded archive remain within the designated staging directory, enabling a classic Zip Slip attack that can overwrite arbitrary files on the host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated user session in Splunk SOAR On-premises with the app-install privilege explicitly assigned - this is a non-default, administrator-granted role permission, not a capability available to standard analyst accounts. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 6.5 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H accurately captures the key risk dimensions: the attack is network-reachable (AV:N) and requires no user interaction (UI:N), but mandates high privileges (PR:H), which substantially narrows the realistic threat population to compromised admin accounts, malicious insiders, or privilege-escalation chains. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has compromised a Splunk SOAR administrator account with the app-install role, or a malicious insider holding that permission, crafts a ZIP archive containing entries with path traversal sequences (e.g., '../../etc/cron.d/backdoor') pointing outside the staging directory. The archive is submitted through the standard SOAR app-installation web interface over the network, and the extraction routine writes the malicious payload to the traversed destination path on the host. … |
| Remediation | The primary fix is upgrading Splunk SOAR On-premises to version 8.6.0 or later, which resolves the path traversal in the archive extraction routine per vendor advisory SVD-2026-0804 at https://advisory.splunk.com/advisories/SVD-2026-0804. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today