Loading vulnerability…
Path Traversal in Splunk App Install REST Endpoint
CVE-2026-20297 is a path traversal vulnerability in the App Install REST endpoint of Splunk Enterprise and Splunk Cloud Platform. Insufficient validation of the explicit_appname parameter allows an authenticated user with both edit_local_apps and install_apps capabilities to redirect file writes during a legitimate app installation outside the intended application directory and into Splunk's configuration directory and its subdirectories. The vulnerability is rated High, with a CVSS v3.1 score of 7.2 and vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits unauthorized file writes outside the application installation boundary, potentially modifying Splunk configuration files and other sensitive files. Such modifications can compromise application integrity and potentially affect confidentiality and availability. Arbitrary code execution and specific data-disclosure mechanisms are not established for this vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround was available at publication. As a risk-reduction measure, review role assignments and restrict the edit_local_apps and install_apps capabilities to trusted users who require them. Capability restrictions do not replace installation of the security update.
Patch, then assume compromise.
Upgrade Splunk Enterprise to the fixed release for the installed branch: 10.4.1, 10.2.5, 10.0.8, 9.4.13, or 9.3.14, or a later fixed release. Fixed Splunk Cloud Platform versions are 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, and 10.1.2507.24 for their respective release lines. Splunk is applying updates to affected Cloud Platform instances; customers should confirm their instance's patch status.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.