CVE-2026-20297— Path Traversal through 'explicit_appname' in the App Install REST Endpoint in Splunk Enterprise
Possible ATT&CK Techniques 3AI
T1547 · Boot or Logon Autostart Execution T1059 · Command and Scripting Interpreter T1105 · Ingress Tool TransferGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-20297
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Path Traversal through 'explicit_appname' in the App Install REST Endpoint in Splunk Enterprise
Source: NVD (National Vulnerability Database)
Vulnerability Description
In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, and 10.1.2507.24, a user who holds a role that contains the `edit_local_apps` and `install_apps` capabilities could cause a legitimate app installation to write files outside the intended app directory, into `$SPLUNK_HOME/etc/` and its subdirectories.<br><br>The vulnerability is caused by a path traversal in the app installation workflow, which does not restrict the installation path to the intended app directory.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Splunk | Splunk Enterprise | 10.4 ~ 10.4.1 | - | |
| Splunk | Splunk Cloud Platform | 10.5.2605 ~ 10.5.2605.0 | - |
II. Public POCs for CVE-2026-20297
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-20297
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-20297 (1)
Same Patch Batch · Splunk · 2026-07-15 · 3 CVEs total
| CVE-2026-20296 | 8.3 HIGH | SPL Command Safeguards Bypass through Cross-Site Request Forgery (CSRF) in Deployment Serv |
| CVE-2026-20298 | 5.3 MEDIUM | Sensitive Information Disclosure through the storage/passwords REST Endpoint in Splunk Ent |
IV. Related Vulnerabilities
Same product: Splunk Enterprise
- CVE-2026-20298
Sensitive Information Disclosure through the storage/passwor - CVE-2026-20296
SPL Command Safeguards Bypass through Cross-Site Request For - CVE-2026-20258
Stored Cross-Site Scripting (XSS) through Classic Dashboard - CVE-2026-20253
Unauthenticated Arbitrary File Creation and Truncation in a - CVE-2026-20252
Server-Side Request Forgery (SSRF) through Dashboard Studio
Same vendor: Splunk
- CVE-2026-20298
Sensitive Information Disclosure through the storage/passwor - CVE-2026-20296
SPL Command Safeguards Bypass through Cross-Site Request For - CVE-2026-20266
OS Command Injection in the btool Configuration Helper in Sp - CVE-2026-20265
Insecure Default Domain Allowlist in Splunk AI Toolkit - CVE-2026-20258
Stored Cross-Site Scripting (XSS) through Classic Dashboard
Same weakness: CWE-22
- CVE-2026-26032
Apache Ivy: PackagerResolver path traversal vulnerability - CVE-2026-12997
Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Rea - CVE-2026-62947
OpenWrt: ACL bypass and arbitrary root file read via cgi-io - CVE-2026-20146
Cisco Identity Services Engine Path Traversal Vulnerability - CVE-2026-62843
File Browser: Archive builder turns backslash filenames into
V. Comments for CVE-2026-20297
No comments yet