CVE-2026-20297

Analyzed Analyzed - Analysis Complete

Path Traversal in Splunk Enterprise and Splunk Cloud Platform

Publication date: 2026-07-15

Last updated on: 2026-07-24

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, and 10.1.2507.24, a user who holds a role that contains the `edit_local_apps` and `install_apps` capabilities could cause a legitimate app installation to write files outside the intended app directory, into `$SPLUNK_HOME/etc/` and its subdirectories.<br><br>The vulnerability is caused by a path traversal in the app installation workflow, which does not restrict the installation path to the intended app directory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-24

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-20297

EUVD

EUVD-2026-44736

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk	From 10.0.0 (inc) to 10.0.8 (exc)
splunk	splunk	From 10.2.0 (inc) to 10.2.5 (exc)
splunk	splunk	From 9.4.0 (inc) to 9.4.13 (exc)
splunk	splunk	10.4.0
splunk	splunk	From 9.3.0 (inc) to 9.3.14 (exc)
splunk	splunk_cloud_platform	From 10.1.2507 (inc) to 10.1.2507.24 (exc)
splunk	splunk_cloud_platform	From 10.2.2510 (inc) to 10.2.2510.18 (exc)
splunk	splunk_cloud_platform	From 10.4.2604 (inc) to 10.4.2604.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This is a path traversal vulnerability in Splunk Enterprise and Splunk Cloud Platform. A user with the edit_local_apps and install_apps capabilities can write files outside the intended app directory during app installation. The flaw occurs due to insufficient path validation in the app installation process, allowing file writes to arbitrary locations within $SPLUNK_HOME/etc/ and its subdirectories.

Detection Guidance

Detecting this vulnerability requires checking Splunk Enterprise and Splunk Cloud Platform versions against the affected releases. Use the following commands to verify installed versions and identify potential exploitation attempts. For Splunk Enterprise, run: splunk version from the command line. For Splunk Cloud Platform, check the version in the Splunk Web UI under About Splunk. Monitor $SPLUNK_HOME/etc/ for unexpected file modifications or new files in subdirectories outside app directories.

Impact Analysis

This vulnerability could allow an attacker to manipulate files outside the intended app directory, potentially leading to unauthorized access or system compromise. An attacker with the required capabilities could exploit this to alter critical system files, install malicious applications, or gain elevated privileges.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected Splunk versions may face legal penalties, reputational damage, or loss of certification if sensitive data is compromised.

Mitigation Strategies

Upgrade Splunk Enterprise to versions 10.4.1, 10.2.5, 10.0.8, 9.4.13, or 9.3.14, or Splunk Cloud Platform to versions 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, or 10.1.2507.24. No mitigations or workarounds are available.

Hi! I’m here to help you understand CVE-2026-20297. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70